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FOREWORD 


This final report presents the results of a literature survey and study effort performed by 
Vought Systems Division (VSD) of the Vought Corporation to determine the hazards of Shuttle 
payload propulsion systems. This report contains a discussion of the methods and purpose of 
hazard classification for transportation and storage, handling/safety procedures and requirements, 
quantitative hazard assessment techniques of solid and liquid rocket systems, a preliminary 
hazard analysis of rocket systems for Shuttle payload, and a hazard comparison of solid and 
liquid systems. The study was coriducted under NASA Contract NAS T 12500, Task R-150. 
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DEFINITIONS 

BASIC EXPLOSIVE TERMS RELATED TO ROCKET PROPELLANTS 

Explosive Any material which decomposes exothermically over a short time 

period to yield high gas pressure or shocks (impulse) in the 
immediate vicinity. 

Propellants High energy materials which are employed in such an environment 

that they react (sometimes at a high rate) but without the destruc- 
tive forces of an explosive. Under certain conditions these materials 
will also function as explosives. 

Explosive A chemical reaction or change of state occurring in a material which, 

Decomposition at a given time, may exist in one of four stages; I.e., initiation, de- 

flagration, transition or detonation. 

Initiation That stage in an explosive decomposition in which a stimulus (i.e., 

heat, shock, etc.) has initiated a decomposition but the decomposing 
substance has not released sufficient energy to proceed beyond the 
burning stage. 

Deflagration The second stage of the explosive decomposition process in which a 

self-sustaining reaction is being carried out. Heat is transferred from 
the reacted to the unreacted material, causing further reaction. Generally 
deflagration is a very slow process and dependent on ambient pressure. 
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T ransition 

GLOSSARY OF TERMS (CONTINUED) 

The 3rd stage of an explosive decomposition in which rate Increases 
from deflagration to a high velocity reaction usually called detonation. 

Detonation 

A steady high-stage rate consumption of the explosive in which energy 
liberated is transmitted to the unburned layers of explosive by means 
of shock waves. In most condensed explosions the rate at which the 
detonation passes through the explosive is 5-8 mm/jusec. 

Explosion 

(A more generalized term than explosive decomposition) 

The sudden release of energy usually in the form of large volumes of 
gas which exert pressure on the surrounding medium. Depending on 
the rate at which energy is released, an explosion can be categorized 
as a deflagration, detonation, or the rupture of a pressure vessel. 

GENERAL EXPLOSIVE TERMS 

Air Blast 

The destructive energy imparted to the atmosphere surrounding an 
explosion. 

Blast Yield 

Energy release in an explosion inferred from measurements of the 
characteristics of blast waves generated by the explosion. 

CBGS 

Confined by Ground Surface. A liquid propellant explosion occurr- 
ing on the ground after spill and mixing. 

CBM 

Confined by Missile. An explosion within the tankage of a liquid 
propellant vessel or rocket. 

Critical Diameter 

(Dc) 

The minimum diameter for solid propellant which will sustain 
detonation when configured as a solid right cylinder. 

Explosive Yield 

Energy released in an explosion, often expressed as a percent or 
fraction of energy which would be released by the same mass of a 
standard high explosive such as TNT. 

Fallback 

An accident in which a launch vehicle settles or falls back to earth 
in initial stages of launch. 

Hazard 

A situation which may result in death or injury to personnel, or in 
damage to property. Includes effect of fire, flash, explosion, shock, 
concussion, fragmentation, corrosion and toxicity. 
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Ignition Time 


Overpressure 


Pseudo-critical 
Geometry (gq) 


Safe and Arm 
Device (S&A) 

Side-on Impulse 

Side-on Overpressure 

Standoff Distance 

Sub-critical Diameter 

Super-critical 

Diameter 

Terminal Yield 


High Velocity Impact. A liquid propellant explosion occurring after 
a vehicle with unburned propellant impacts the earth at relatively 
high velocity. 

Time after beginning of an accident involving liquid propellants at 
which initiation of an explosion occurs. 

The transient pressure exceeding the ambient pressure, manifested 
in the shock (or blast) wave from an explosion. The variation of 
the overpressure with time depends on the energy yield of the 
explosion and the distance from the point of burst. The peak over- 
pressure is the maximum value of the overpressure at a given 
location and is generally experienced at the instant the shock (or 
blast) wave reaches that location. 

An empirical relationship for hollow-core non-solid circular shapes 
which is defined as four times the ratio of the cross-sectional area 
to total perimeter for the smallest sample size that can sustain 
detonation. 

An electro-mechanical device used to insure initiation of pyrotechnic 
train on proper command and to prohibit initiation of the train by 
an inadvertent firing signal. 

Integral of time history of side-on overpressure 

Blast wave overpressure in an undisturbed blast wave. 

Distance from center of an explosion. 

Diameter smaller than the critical diameter. 

Diameter greater than the critical diameter. 


Blast yield from measurements made far enough from an explosion 
that the waves are similar to those generated by a specified mass of 
TNT. 
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1.0 SUMMARY 


The federal, state, and municipal governments regulate the transportation and storage of 
explosives by law. The Department of Transportation (DOT) and the Department of Defense (DOD) 
are the federal regulatory agencies. The DOT classification for transportation, the military classifi- 
cation for quantity-distance, and hazard compatibility grouping used are presented; however, the 
tests required to establish the hazard classification do not show this total response of a solid propellant 
motor under the influence of a large explosive donor. There are some industry developed tests which 
are possibly more relevant in determining sensitivity of propellants to an impact/shock environment 
in the absence of a large explosive donor and these are also discussed. 

The safety procedures and requirements of a Scout launch vehicle. Western and Eastern Test 
Range and the Minuteman, Delta, and Poseidon Programs are reviewed and summarized. In reviewing 
the safety requirements and practices of these programs, it was determined that the basic hazardous 
situations guarded against were common to all solid rocket programs. 

Hazardous environments of major concern are impact, shock, friction, radio frequency, static 
or stray electrical energy and excessive temperatures. Handling safety requirements are not generally 
based on the hazard of explosion or detonation of the solid rocket but the primary concern is prema- 
ture ignition. Impact and shock environments are primarily a concern from the standpoint of damage 
which will cause system failure upon normal ignition. The static electricity or stray electrical energy 
hazard is reduced by using proper grounding of systems, personnel ground devices, terminating opera- 
tions during electrical storms, reducing or eliminating RFI during launch, using safe/arm devices and 
other shunting and shielding techniques. Requirements of the Space Transportation System safety 
program include safety reviews from the subsystem level to the completed payload. The Scout safety 
procedures will satisfy a portion of these requirements but additional procedures need to be imple- 
mented to comply with the system safety requirements for Shuttle operation from the Eastern Test 
Range. 


To determine the hazards associated with solid and liquid propellants due to ignition, explosion 
or detonation; impact, donor charge and missile accident data were reviewed. The relative safety of 
solid rocket motors is shown from these data. A review of component and system accidents showed 
that most were caused by procedural or design deficiencies. Proper attention in these two areas 
throughout system design provides for safe vehicle processing. 

Impact velocity testing and data show that the inert-exp losive/burn regions for composite 
and composite-modified double-base propellants are about the same but the composite-modified 
double-base propellant had a lower impact velocity for possible detonation than the composite 



propellants. An impact velocity is excess of about 52 ft/sec (15.8 m/sec) and 59 ft/sec (17.9 m/sec) 
would be required for the Antares II X259 and the Altai r IMA, respectively, to cause a hazardous 
condition. 


Data show that composite propellants are relatively safe from donor charge detonation when a 
sub-critical diameter, below 64.2 inches, for a PBAN composite propellant is used. However, double- 
base propellants and composite propellants with high energy additives in the range of 10 percent 
or more by weight have critical diameters of two inches or lower. 


The characteristics of an explosion or detonation of solid and liquid propellant systems can be 
determined from the figures presented in the text. Parameters such as TNT equivalency, overpressure, 
fragmentation, fireball size and duration are shown. 

A preliminary hazard analysis approach was used to analyze the hazardous situations of liquid 
and solid rocket propulsion systems and their interface with the Orbiter vehicle. The third and fourth 
stage solid rocket motors of the Scout launch vehicle were used as typical propulsion systems. It was 
determined that safety procedures, qualification tests, payload pallet design, thermal insulation, and 
electrical system design consideration can be used to provide hazard reduction or elimination. 

Liquid systems normally contain inherent hazards in at least three areas; high pressure gas 
systems, ordnance devices and propellants. The main concern related to liquid systems is to provide 
an environment such as temperature, shock, vibration, impact or tank pressures which will prevent 
the fuel and oxidizer from mixing. In any form. Inadvertently. 

A comparison of preliminary hazard analyses of the liquid and solid propellant systems show 
that liquids Inherently have more hazardous situations or conditions which could be catastrophic or 
critical to the Shuttle system than solid propellant systems. From a system's viewpoint the solid 
system should be considered much safer than a liquid system and more desirable for use as a Shuttle 
payload system. 
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2.0 INTRODUCTION 


Licjuid rocket propulsion systems have been used extensively in previous manned spaceflight 
programs with high success. With the advent of the Space T ransportation System, many types of 
vehicles were and are considered candidates as payloads in this system. Shuttle payloads proposed 
included a number of the upper stage vehicles, such as Agena, Centaur, Transtage, Burner II and 
upper stages of Scout and Delta which could be used to deliver payloads to orbits beyond the 
Orbiter vehicle operating mode or the basic launch vehicle orbit capabilities. Most of the systems 
under consideration in the early 1970's utilized liquid cryogenic or storable propellant systems. 
Safety/hazard studies were performed on these liquid systems to determine the hazardous situations 
or effects that could occur by using payloads that contained liquid propellant as payloads in the 
Orbiter. It was determined that many safety features were required, such as inert gas purge bags, 
dual propellant isolation solenoid or squib valves, dual electrical systems, special design considerations 
for dumping propellants and special safety /operating procedures. The solid propellant safety question 
came to the forefront because of the inherent design simplicity of the solid propellant rocket system. 

In fact, the Shuttle strap on booster system was changed from a liquid to a solid propellant system in 
the early 70's. In view of this, the present study was undertaken to address the hazard of solid rocket 
motors as a payload in the Shuttle Orbiter vehicle. In this report the U. S. Customary Units are used 
and SI Units follow in parentheses or conversion factors are provided. This format is followed through- 
out except for temperature which is presented in some cases as ®C. 


2.1 Scope 

The scope of the study was based on the interface of the Space Transportation System 
Orbiter vehicle and the Scout launch vehicle third stage, Antares II X259, and the fourth stage, 

Altair MIA solid propellant motors. These motors are composite-modified double-base propellant, 
Department of Transportation Class A, Department of Defense Class 7; and composite propellant. 
Department of Transportation Class B, Department of Defense Class 2, respectively. Even though 
the Scout solid motors were used as a baseline, the study is applicable to composite and double-base 
rocket motors in general. Also, to enhance the study on solid propellant systems a portion of the 
study was delegated to liquid propellant systems. 

The liquid propellant portion of the study was based on the Scout launch vehicle hydrogen 
peroxide (H 2 O 2 ), monopropellant, reaction control system and the Agena unsymmetrical Dimethyl- 
hydrazine (UDMH) - high density acid (HDA), bipropellant system. The liquid study portion can 
also be considered applicable to liquids in general except in those cases where the type of fuel or 
oxidizer present a unique situation, such as the low temperatures of liquid oxygen and liquid hydro- 
gen. In these unique situations special considerations must be addressed in order to ascertain the 
hazardous situations and develop resolution criteria. 
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2.2 Study Objectives 


The study involved the consideration of five different but related subject items. These items 
and their objectives are: 

1. Hazard Classification For Rocket Propellants - The objective was to review the solid 
propellant explosive classification methodology and criteria used by the Department of 
Transportation (DOT) and the Department of Defense (DOD) and determine if the 
classification is applicable to the Shuttle program solid rocket system payloads. 

2. Rocket Safety Requirements and Experience — The objective was to identify hazards 
associated with the handling of solid rocket motors by reviewing the handling procedures 
and hazardous incidents of other programs. 

3. Assessment Techniques-Solid and Liquid Propulsion Systems - The objective was to 
develop a quantitative assessment technique which would establish the threshold 
required to create a hazardous situation and the possible consequences of the situation. 
The technique was to be developed from data obtained from literature on controlled 
tests. 

4. Preliminary Hazard Analysis of Rocket Systems for Shuttle Payload — The objective 
was to review the Shuttle operating environment and determine incidents which could 
lead to a hazardous situation when considering a solid or liquid propellant system 

as a payload and to evaluate and compare the hazards involving liquids and solid propul- 
sion systems based on the shuttle flight operating modes and hazardous conditions. 
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3.0 HAZARD CLASSIFICATION FOR ROCKET PROPELLANTS 


3.1 Introduction 

Accidental ignition of combustibles or explosives can cause extensive material damage to 
facilities, human injury, and fatalities. Table 3-1 presents data on vapor cloud explosions and gives 
the monetary loss in millions of dollars, as well as the number of fatalities. Damage by an explosion 
is caused by the heat and/or detonation effects which are caused by the tremendous release of energy 
which are sufficient to cause blast waves and heat radiation. Figure 3-1 1 shows the blast damage that 
occurs due to overpressure as a function of scaled distance. From this data, it can be determined that 
3000 pounds of TNT gives an overpressure of about .006 psi at approximately 5 miles and represents 
the limit for glass breakage. Overpressure of about 0.1 psi causes about 50 percent glass breakage at 
2800 feet and probable total destruction of a reinforced concrete building at 10 psi overpressure at 
140 feet. If the explosive weight is reduced to 2.0 pounds of TNT and .5 psi overpressure, it can be 
determined that this blast effect would be noted at 95 feet. This would represent the distance and 
overpressure for minor structural damage. To protect life and property, safety precautions must be 
provided to preclude inadvertent exposure of facilities and personnel to such hazards. The method 
used by the governments — federal, state, municipal, for this purpose is regulation by laws. 


3.2 Responsible Federal Agencies 

3.2.1 Department of Transportation (DOT) . — Section 833, Title 18 of the United States 
Code provides that: 

Any person who knowingly delivers to any carrier engaged in interstate or foreign 
commerce by land or water, and any person who knowingly carries on or in any car 
or vehicle of any description operated in the transportation of passengers or property 
by any carrier engaged in interstate or foreign commerce by land, any explosive, or 
other dangerous article, specified in or designated by the Department of Transportation 
pursuant to Section 834 of this chapter, under any false or deceptive marking, descrip- 
tion, Invoice, shipping order, or other declaration or any person who so delivers any 
such article without informing such carrier in writing of the true character thereof, 
at the time such delivery is made, or without plainly marking on the outside of every 
package containing explosives or other dangerous articles the content thereof, if 
such marking is required by regulations prescribed by the Department of Transportation, 
shall be “fined" or imprisoned, as provided in the Act. 

Also Section 834 of the Act authorizes the Department of Transportation (DOT) to formulate regu- 
lations for the safe transportation of hazardous materials. The DOT regulations formulated and issued 
for the transportation of hazardous materials is contained in the Code of Federal Regulations — Title 
49 (49CFR), reference 1. In accordance with 49CFR, no explosive (except properly packaged 
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TABLE 3- 1. - A FEW RECENT VAPOR CLOUD EXPLOSIONS WHICH PRODUCED BLAST DAMAGE (REF. 2) 


Location 

and 

state 

Fuel 

and 

quantity 

Delay 
time to 
ignition 

Loss 

dollars 

& 

fatalities 

TNT 
yield 
based on 
overpressure 

Evidence 

for 

detonation 

References 

Berlin, N.Y. 
July 26, 1962 

LPG 

1,500 kg 

Minutes 

$200,000 

10 

Unknown 

Dwelling exploded 

Walls '63 

Lake Charles, LA 
August 6, 1967 

Butane 
Butylene 
9,000 kg 

Unknown 

$35 M 
7 

9,000 to 
11,000 kg 
(10%) 

Not reported 

Goforth '69 

Pern is. 

The Netherlands 
Jan. 20, 1968 

H.C. Slops 

> 13 min. 

$46 M 
2 

18,000 kg 
{-) 

Fire before 
severe explosion 

MSAPH '68* 
Fontein '70 

Franklin Co., MO 
Dec. 9, 1970 

Propane 
30,000 kg 

13 min. 

$1.5 M 
0 

45,000 kg 
(10%) 

Pump house de- 
stroyed by internal 
explosion 

Burgess and 
Zabatakis '73 
NTSB '72at 

East St. Louis, 1 L 
Dec. 22, 1972 

Propylene 
65,000 kg 

> 5 min. 

$7.6 M 

1,000 to 
- 2,500 kg 
(.3%) 

Box car destroyed 
by internal 
explosion 

Strehlow '73a 
NTSB '73a 

Elixbou rough, 
England 
June 1, 1974 

Hot 

Cyclohexane 
50,000 kg 

> 1 min. 

>$100 M 

18.000 to 

27.000 kg 
(5%) 

Fire before severe 
explosion 

Kletz '75 
Kinnersly '75 
Slater '74 

Decatur, 1 L 
July 19, 1974 

Propane 
65,000 kg 

> 5 min. 

$15 M 

5,000 to 
10,000 kg 
(2%) 

Fire before 
explosion. Box car 
destroyed by 
internal explosion 

Benner '75 


* MSAPH = Ministry of Social Affairs and Public Health 
t NTSB = National Transportation Safety Board 




test samples) can be transported by common carrier, whether military or civilian, if it has not been 
classified by similarity or testing by the Department of Defense or the Bureau of Explosives and 
approved by DOT. Therefore, it is the responsibility of DOT to provide regulation for the proper 
protection of the public during transportation of hazardous materials by common carriers. Rules 
are formulated by the DOT Hazardous Materials Regulations Board which is composed of the 
Assistant Secretary of Safety and Consumer Affairs, Commandant U. S. Coast Guard, Federal 
Aviation Administration, Federal Highway Administration, and Federal Railroad Administration. 

The signature of the Board member adopting a regulation for a mode of transportation determines 
the applicability of that notice or rule to that mode of transportation. Where more than one mode 
is involved, the requisite number of authorized signatures is involved. Any person may petition the 
board to issue, amend, or repeal a rule. Also, a petition can be filed to obtain a special permit for a 
waiver or exemption from the provisions in 49CFR pertaining to explosives. 

3.2.2 Department of Defense (POD) . — The Department of Defense through the activity of 
the Department of Defense Explosive Safety Board (DDESB or ESB) sets forth joint regulations for 
explosive hazard classification procedures. Specifically, their interest lies in manufacturing, testing, 
handling, reworking, disposal, transportation, storage, and siting to prevent hazardous conditions 
from occurring which could endanger life and property inside and outside DOD installations. The 
DDESB Is composed of a chairman and a member from each of the Military Departments. It is 
required by DOD Directive 5154.4, reference 3, that the Secretaries of Military Departments and 
Directors of the Defense Agencies, or their designees, must perform evaluation and tests to assign 
hazard classifications for military handling, storage, group compatibility, and transportation of 
explosives. 

The transportation classification is required to meet the DOT regulations. Hence, a complete 
hazards classification consists of quantity-distance class, storage compatibility group, DOT class, and 
DOT marking. These requirements are outlined in the DOD Document DOD4145.26M, reference 4. 


3.3 Classification 

In 49CFR (paragraph) 173.50, "an explosive is defined as any chemical compound, mixture, 
or device, the primary or common purpose of which is to function by explosion, i.e., with substan- 
tially instantaneous release of gas and heat, unless such compound, mixture, or device is otherwise 
specifically classified. . ." Explosives which are acceptable for transportation are classified by the 
DOT into three (3) classes. 

(a) Class A — detonates or is of maximum hazard 

(b) Class B — flammable or fire hazard 

(c) Class C — minimum hazard 

These three classes are aids in helping the DOT to formulate regulations for proper separation 
and packaging of hazardous items during freight transportation. When shippers abide by the regula- 
tions the extent of damage can be minimized in case of accident. 
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3.3.1 Testing. - Classification testing can be performed by either the Bureau of Explosives 
or DOD, 49CFR 173.86. Since the DOT accepts the testing provided by either of these agencies, it 
basically shows DOT recognition of the DOD Technical Bulletin, DSAR8220.1, reference 5, also 
known asTB700-2, NAVORDINST8020.3,TO 11A-1-47. TB700-2 specifies testing to be performed 
to classify bulk explosive and solid propellant compositions to meet DOT regulations and testing of 
assembled rocket motors for quantity-distance criteria determinations. 

3.3.1. 1 Bulk solid propellant: Figure 3-1 gives an outline of the tests to be performed for 
DOT requirements. Tests include the following: 

(a) Detonation Test ~ A solid lead cylinder V/ 2 -inch diameter by 4 inches high is placed 
upon a mild steel plate, SAE1010 to 1030, y 2 -inch by 12 inches. A 2-inch cube of 
propellant is placed on top of the lead cylinder and a No. 8 blasting cap is positioned 
on top centerline of the propellant cube and fired. Deformation of the lead cylinder 
is evidence of detonation. This test is performed a minimum of five times. If this 
test is positive, the Bureau of Explosives requires the impact sensitivity test. 

(b) Impact Sensitivity Test — A propellant sample 0.20-inch diameter by 0.10-inch long 
is placed in the cup assembly of the Bureau of Explosives impact apparatus and the 
weight is dropped on the sample from 3-3/4 inches or 10 inches, 10 trials, respectively. 
The reaction is tabulated under the heading of explosion, flame and noise, decomposi- 
tion, no reaction, etc. 

(c) Ignition and Unconfined Burning Test — The 2-inch propellant cubes are placed 1) 
singularly, 2) in line in a group of four, on a bed of kerosine-soaked sawdust and the 
sawdust ignited with an electric match-head. The results are recorded under the 
headings of "exploded" or "average burning time". 

(d) Thermal Stability — A 2-inch propellant cube is placed in a constant temperature 
explosion- proof oven. The temperature of the oven Is held at 75°C for a period of 
48 hours. The results are recorded as explosion, ignition and change in configuration. 

(e) Card Gap Test — This test is not performed by the Bureau of Explosives unless 
required by the user. DOD requires this test as part of TB700-2. A 6-inch square by 
3/8-Inch thick mild steel plate, SAE1010-1030, is supported above the ground. 

Resting on top of the steel plate is a cardboard tube which contains a steel, cold-drawn 
seamless tube, SAE1050, 1-7/8-inch-OD by 0.219-inch wall by 5Yi inches long and 
containing the cast propellant sample. This steel-sample tube is placed above the 
witness plate with an air gap of 1/16 inch. Two pentolite pellets, 2-inch diameter by 
1-inch long are placed above the steel tube-sample and one engineer's special blasting 
cap J-2 is placed at top centerline of the pentolite pellets. The test samples and 
apparatus are controlled to 25®C ± 5°, and a firing test is performed. If the propel- 
lant sample detonates without a cellulose acetate card between it and the pentolite 
boosters, a series of tests are performed with a given number of cellulose acetate 
cards. Cellulose acetate cards 2-inches in diameter by 0.01 inch thick, are placed 
between the charge and test sample based on the "detonation — no detonation" 
situation. A series of tests are performed until the number of cards is obtained to 
give a 50 percent probability of detonation. 
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Date 

Sponsoring Agency 

Contract No. 

Propellant Identity (Type No.) 

Propellant Spec. Batch 

Mfg. Date 


Detonation Test 


Exploded Burned Fragmented 

Yes No Yes No Yes No 

No. 8 Blasting Cap Test I . 

Test II 

Test III 

Test IV _ — 

Test V . 

Samples: Five 2-inch cubes. Test: One blasting cap per sample. 


Ignition & Unconfined Burning Test Exploded Average Burning Time 

Yes No Seconds 

One 2-inch cube 

One 2-inch cube — - — — 

Four 2-inch cubes 

Samples; Six 2-inch cubes. Test: Ignite & bum unconfined. 

Thermal Stability Test Explosion Ignition Change in Configuration 

Yes No Yes No Yes No 

One 2-inch cube — — 

Samples: One 2-inch cube Test; 48 hours at 75° C. in vented oven. 

Card Gap Test 50% Value (No. of Cards) 


Impact Sensitivity Test 


Bureau of Explosives Impact Apparatus 


Ten 3%" (± 1/16") Drop Test Ten 10" (± 1/16") Drop Test 

10 Trials 10 Trials 


No. of Trials Exhibiting 

No. of Trials Exhibit! 

ng 

Explosion 
Flame and 
Noise 

Decomposition 
Smoke 
No Noise 

No Reaction 
No Smoke 
No Noise 

Explosion 
Flame and 
Noise 

Decomposition 
Smoke 
No Noise 

No Reaction 
No Smoke 
No Noise 


Approved : 

Test Director Test Department Head 


DOD Approval 

Signature 

Title 

Organization 

•Shipping Instructions are to be requested from ICC (para 3-13a(2). 


Assigned Classification 

ICC Forbidden 
ICC Restricted* 
ICC Class A 
ICC Class B 




FIGURE 3-1. - SAMPLE SUMMARY DATA SHEET, TB700-2 

AGO 7931A 
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3.3.1 .2 Assembled motors: Figure 3-2 presents an outline of the minimum testing which 
may be performed on assembled solid rocket motors to determine the effect of an explosion on like 
items and mixed classes, on a remaining assembled vehicle and the firing of a destruct system relative 
to the individual motor and the assembled vehicle. The results of these types of tests may be used 
for siting flight test stands or tactical siting of assembled missiles. Limited quantity research items 
not used as standard military items are exempt from performing these types of tests if the DOT 
Class A and the appropriate military hazard class are acceptable. Generally the tests outlined in 
TB70O2 Chapter 3 are not performed by non-military organizations on launch vehicles. 

3.3.2 Assignment of Classifications . — For DOT and military purposes, the above testing 
results are interpreted and classified as follows: 

(a) DOT "Forbidden" if the following occurs {see also 49CFR 173.51): 

Thermal stability test results in either an explosion, burning, or marked 
decomposition of the sample. 

(b) DOT Restricted. Compositions with an explosive impact sensitivity of less 
than 4 inches of drop height will not be shipped until shipping instructions 
have been requested and received from the Department of Transportation. 

(c) DOT Class A — (Military Class 7) (see also 49CFR 173.53) if one or more 
of the following occur: 

1. Detonation and card gap tests have determined a detonation sensitivity 
value of 70 or more cards. 

2. Impact sensitivity test produces an explosion above 4-inches of drop height. 

3. Ignition and unconfined burning test produces a detonation. 

(d) DOT Class B — (Military Class 2) (see also 49CFR 173.88) If alt of the 
following occur: 

1. The ignition and unconfined burning test did not result in an explosion. 

2. The Thermal Stability Test did not result in an explosion, burning, or 
marked decomposition. 

3. Detonation and card gap tests have Indicated a detonation sensitivity value 
of less than 70 cards or no reaction at zero cards. 

(e) DOT Class C — (Military Class 1) — Those explosives not in the above 
Class (A) or (B) and considered a minimum hazard. 

3.3.3 Quantity-Distance Standards . - As shown in paragraph 3.3.2, when a propellant is 
classified for DOT transportation requirements, a DOD military class is also assigned by correlation 
for quantity-distance purposes, DOD 4145.26M, reference 4, Part 7 outlines the DOD standards 
for quantity-distance storage of solids type explosives and Part 8 covers liquid propellants. 

3.3.3. 1 Solid propellant classes: The DOD classes for solid propellants are described as follows: 

(a) Class 1 (Fire Hazards) are "Items which present a high fire hazard with no blast 
hazard and virtually no fragmentation or toxic hazard beyond the fire hazard 
clearance ordinarily specified for high-risk material." Items in this class consist of 
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FIGURE 3-2. - MINIMUM TEST CRITERIA FOR DOD ROCKET MOTORS OR 
DEVICES CONTAINING SOLID PROPELLANT 












small arms ammunition without explosive projectiles, fuse lighters and squibs. 

(b) Class 2 (Fire Hazards) are "Items which burn vigorously with little or no possibility 
of extinguishment in storage situations. Explosions normally will be confined to 
pressure ruptures of containers and will not produce propagating shock waves or 
damaging blast pressure beyond the magazine distances . . Items in this class 
are military pyrotechnics, solid propellants in bulk and in containers (composite 
pcopellants such as used in the Scout launch vehicle Castor II rocket motor are Class 2). 

(c) Class 3, 4, 5 and 6 (Combined Hazards) are items "which the principal hazards may 
be fragments, toxicity, or blast, either individually or in combination. . .". Items in 
this class are small arms ammunition with explosive bullets and hand grenades. These 
classes are not of interest for the Scout vehicle. 

(d) Class 7 (Mass Detonating Hazards) are items "most of the entire quantity of which 
will explode virtually instantaneously when a portion is subject to fire, to severe 
concussion or impact, to the impulse of an initiating agent, or to the effect of a 
considerable discharge of energy from without”. Items in this class are bombs, 
detonators, demolition explosives, missile war-heads, rockets and components having 
mass-detonating characteristics. Rocket motors, such as the Antares X-259, which 
contain double base propellants are considered in this class. 

There are other military classes rated higher than 7 by the different military branches but are 
of no interest for this study. 

3.3.3. 2 Liquid propellant classes: Liquid propellants also constitute types and degrees of 
hazards and are separated into hazard groups and storage compatibility for quantity-distance storage 
rather than the class separation of solids. These hazard groups are as follows: 

Group I are liquids which are considered the least hazardous. There is a 
fire hazard potential and some degree of separation distance is required. Items 
such as alcohols, hydrocarbon fuels and nitrogen tetroxide are in this group. 

(b) Group 1 1 are liquids which are strong oxidizers and cause vigorous oxidation 
which results in serious fires. Items such as 52% hydrogen peroxide, liquid 
fluorine, liquid oxygen and oxygen difluoride are in this group. 

(c) Group III are liquids which present a hazard from pressure rupture of the storage 
container because of fire or deflagration, and vapor phase explosions which result 
in fragmentation of container or adjacent material. Items such as hydrazine, 
hydrazine-UDMH, liquid hydrogen and monomethylhydrazine are in this group. 

(d) Group IV are liquids which, like the mass-detonating solid explosives, cause 
blast overpressures as well as severe fragment hazards from containers and 
surrounding material. Items such as nitromethane and tetranitromethane are in 
this group and under certain conditions 52% hydrogen peroxide is included in 
this group. 

It is of interest to note at this time that the Space T ransportation System uses a Class II solid 
propellant for the two (2) main boosters and liquid oxygen (Group II) and liquid hydrogen (Group 
III) for the main liquid boost propulsion system. The Orbiter reaction control system uses mono- 
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methylhydrazine (Group III) as the fuel and nitrogen tetroxide (Group 1) as the oxidizer. The 
Scout vehicle contains Class 2 and 7 solid propellant rocket booster motors and 90% hydrogen 
peroxide (Group II or Group IV) liquid propellant in the reaction control system. 

3.3.4 Compatibility Groups. — Solid and liquid propellants are both separated into compati- 
bility groups using an alphabetical title, such as, Group A, Group B, etc. Even though both types of 
propellant use the same grouping title they are not comparable. The purpose of the classification is 
to separate the different explosives into groups which can safely be stored together. Additional 
and specific information should be obtained from reference 4 or the appropriate volumes of manual 
CP I A/1 94, reference 6. 


3.4 Validity of Classifications 

The Department of Defense Explosive Safety Board, the Department of Transportation and 
the Bureau of Explosives were contacted to discuss the testing requirements for the classification of 
rocket propellants as explosives. The consensus received from these contacts is that the testing 
required for transportation classification and the established quantity-distance requirements with the 
grouping for compatibility storage has performed and still performs satisfactorily to protect public 
and private property. The tests required provide an indicator of what to expect of large batches of 
propellants under various environments as a minimum. Those showing unsatisfactory results are 
forbidden or restricted. However, the DDESB is a proponent for the utilization of the card gap test 
on all explosives tested so that relative sensitivity can be determined. The Bureau of Explosives does 
not require the card gap test and does not require the impact sensitivity test unless positive response 
is obtained on the detonation test. 

Some in industry, reference 7, do not believe that the mandatory tests of TB700-2 are 
totally relevant and that as the ingredients of Class 2 propellants are modified with high energy 
Ingredients to increase performance the characteristics of a Class 7 propellant are soon reached. It is 
recommended in reference 7 that relevant tests must be used to determine the proper hazard 
classification. Three tests indicated to have been used during the last decade and determined to be 
relevant are the Shotgun, Susan and Flying Plate tests. Characteristics of these tests are asLfollows; 

(a) Shotgun Test — A sample of propellant is fired from a shotgun against a flat plate 
with a velocity between 100 and 2700 feet per second. There are at least two areas 
where data can be obtained from this type testing. The first data represents the 
velocity at which ignition of the sample occurs upon impact and then the higher 
velocity where detonation occurs. A series of tests can be performed on various 
types of compositions or propellants at the same critical dimension to obtain an impact 
velocity map. Results of various full scale tests (ref. paragraph 5.3.1) can also be located 
on the velocity-critical dimension plot to show the scaling from sub-scale to full-scale 
tests. The second data is obtained from the propellant particles. The propellant parti- 
cles obtained from impacts below the ignition threshold are placed into a pressure bomb 
and ignited. The pressure rise vs time is measured. The measured response is rated 


13 



to level of quickness (psi per sec). This test is designed to indicate quickness between 
different propellant types or compositions if the propellant shatters upon impact and 
an initiation stimulus is received at the same time. The greater the quickness, the 
greater the susceptibility to detonation. 

(b) Susan Test — A propellant sample of one pound or less is mounted in the front surface 
of a 10-12 pound projectile and fired from a converted naval gun at velocities from 
100 to 1200 fps onto a solid steel target. The blast overpressure, emitted light and 
the time between Impact and blast wave observation are measured. An energy of 
reaction Is determined and noted on a scale up to 100 as a function of impact velocity. 
This test is designed to assess the relative behavior (sensitivity) of the propellant to 
impacts during operation usage. The energy of reaction can be plotted as a function 
of impact velocity. Hercules, Magna, Utah, has found that this test is not very useful 

In separating the various propellants but it does help separate the propellants from 
the high explosives such as TNT and RDX. 

(c) Flying Plate Tests ~ A flat plate is propelled at samples of propellant. Based on the 
thickness of the flat plate the weight and velocity of the plate can be varied. In this 
method the pulse width of the shock pressure imparted to the propellant sample can 
be varied. Knowing the flying-plate velocity, the shock pressure generated on impact 
at the plate-propellant interface can be determined by the Hugonist reflection method. 

3.5 Conclusion 


Solid and liquid propellant motors in the passive state contain a large amount of potential 
energy. The release of this energy in an uncontrolled situation can cause extensive damage to 
facilities and personnel. The federal, state and municipal governments regulate the transportation 
and storage of explosives by laws. The Department of Transportation (DOT) and the Department 
of Defense (DOD) are the federal regulatory agencies. They require that explosives be tested for 
hazard classification. The testing is performed by the Bureau of Explosives or the Department of 
Defense. The hazard testing requirements for solid explosives (propellants) for both civilian and 
military applications are basically outlined in DOD Technical Bulletin, DSAR8220.1. The liquid 
explosives (propellants) are also tested In similar fashion for hazard classification. 

The DOT classification for transportation, the military classification for quantity-distance 
and the hazard compatibility grouping used at present are believed to be satisfactory for the purpose 
intended. However, these tests do not show the total response of a complete, assembled solid pro- 
pellant rocket or vehicle on the launch pad under the influence of a large explosive donor, motor 
dropping during build-up and a fallback during launch. 

In the last few years Industry has used some additional tests which they feel are more relevant 
in determining sensitivity of propellants to an impact/shock environment in the absence of the huge 
donor explosion. These tests are the shotgun, susan and flying plate. The other alternatives are full 
scale drop tests of the actual motors to be considered for use and testing for shock sensitivity with 
large donor explosions. Further characterization of solid propellant rockets should require full scale 
temperature sensitivity testing similar to methods outlined in Appendix B. 
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4.0 ROCKET SAFETY REQUIREMENTS AND EXPERIENCE 


4.1 Introduction 

Safety is of primary concern when using any component which has high potential energy that 
can be readily transformed to kinetic and thermal energy. A solid or liquid propellant rocket system 
contains all the required constituents to sustain a combustion process and under certain conditions 
a fire, explosion/deflagration or detonation can occur. The inadvertent release of this energy in either 
a controlled or uncontrolled mode can cause severe personnel injury or death and extensive damage 
to facilities. Government and industry have developed safety principles over the years through the 
process of decision-making based on scientific data and industry practice with system feedback for 
safety criteria modification. This method has provided a data base to the extent that well charac- 
terized propellant formulations can be used extensively and safely. With the advent of the anticipated 
utilization of solid propellant rockets as a subsystem of a payload to be carried into orbit by the 
manned space Shuttle -Orbiter vehicle, safety of solid propellants in the shuttle environment was a 
logical consideration. A natural approach to this consideration is to review the safety and handling 
procedures of various existing programs and to collect historical hazardous situations or incidents 
that have occured. This information can be u^d in comparison with the Scout launch vehicle 
safety criteria and procedures to determine if present Scout requirements could result in a hazardous 
situation. The results of this effort are presented In this section of the report. 


4.2 Safety Procedures 

4.2.1 Scout. — The Scout launch vehicle processing and safety requirements are controlled 
through the Standard Operating Procedure (SOP) manual. However, as outlined in SOP Volume 111, 
Section 1, Rocket motors and Pyrotechnics Manual, the detailed safety precautions such as 
smoking restrictions and open flame regulations are not covered by the SOP, but the range safety 
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requirements prescribed at each range site rule. Basic ordnance operation safety requirements which 
are adhered to are as follows: 


(a) Maximum of five ( 5 ) persons are present during live motor processing. 

(b) Personnel wear safety clothing. 

(c) Personnel use only approved tools and equipment. 

(d) Operations are terminated when electrical storms are within area. 

(e) Proper grounding is used at all times, especially during open propellant 
rocket motor processing or when the initiators and Igniters are installed. 

(f) Initiator pins or wires shorted with approved shorting devices. 

(g) Equipment maintenance performed per requirements. 

(h) Cautious handling of explosives to prevent dropping. 

(i) Transporting and storage of rocket motors is according to Department 
of Transportation classification and storage is per quantity distance 
standards, as they are applicable to the site Range Safety. 

(j) Rocket motors are stored within certain temperature limits. 


Basic hydrogen peroxide safety requirements which are adhered to are as follows: 


(a) A large quantity of water is available during handling of H2O2 and 
spillage is flushed at once. 

(b) Use of buddy system during H2O2 drainage, transfer and sampling 
operations, with one man assigned to the water source. 

(c) Protective clothing is worn to prevent clothing fires. 

(d) All lines and fittings, which have contained H2O2, are flushed with 
water before handling and repair and subsequent repassivation performed. 

(e) All materials combustible with H2O2 are kept away from handling 
and storage areas except as required. 

(f) All open systems are protected from contamination by compatible 
plugs or covers. 

(g) All equipment and containers used with H2O2 are clean and passivated. 

(h) All presajrization nitrogen used with H2O2 is dry, filtered, and oil free. 

(i) Storage containers are Inspected periodically for signs of leakage and 
activity. Steps to control activity are taken at once. 

(j) Good ventilation is maintained In storage areas. 

(k) Protective face shields are used during H2O2 handling. 

(l) Vapor inhalation is cautioned against. 


Within the context of the SOP, notes, cautions and warnings are outlined as necessary before 
given tasks. "Notes" specify to the operators that special care must be taken so that a task will be 
performed properly. The "Caution" note specifies to the operators that damage to the equipment 
may result if procedures are not followed. The "Warning" note is the most important from a hazard 
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viewpoint because it specifies to the operators that procedural error can cause loss of life or serious 
personnel injury. 

SAMTEC 127-1, reference 8, Range Safety Manual, outlines the safety considerations for 
Systems Analysis, Flight Analysis, Pad Safety and Flight Operations. The SAMTEC ordnance safety 
requirement is summarized as follows: 

The accomplishment of work involving ordnance materials, missile fuels and oxidizers, 
high pressures, and nuclear components, will be in accordance with approved detailed 
procedures. Chronology will be maintained and departures from the approved procedures 
will not be allowed without approval for the variance. The agency responsible for per- 
forming the hazardous work will prepare the required detailed procedures for the work 
and secure SAMTEC/SE approval prior to work accomplishment. 

The approved detail procedures take into consideration the contents of 1STRADM 127-200, reference 
9, Missile Mishap Prevention; AFM 127-100, reference 10, Explosive Safety Manual; AFM 127-101, 
reference 1 1 Accident Prevention Handbook. 

The Vought field operations are conducted under the “NASA/DOD Scout Launch Complex 
Safety Plan”. This Safety Plan is approved by Vought Safety; Vought Launch Operations; USAF 
Chief, Scout Division 6595th STG and SAMTEC Missile Ground Safety. The Plan requires compliance 
with the above referenced documents, as well as other referenced applicable Government documents 
issued by the Department of Defense, Department of Transportation, Occupational Safety and 
Health Act, NASA Safety and Health Clause. The Plan also specifies that the Scout Field Super- 
visory Personnel will be responsible for carrying out the duties of the Task Supervisor as outlined 
In 1STRADM 127-200, Chapter 7, which states: 

"While the requirements contained in this manual are primarily designed for hazardous/ 
dangerous operations, the basic safety philosophy applies for all operations conducted 
at Vandenberg. IF YOU ARE THE TASK SUPERVISOR, YOU MUST INSURE THAT 
ALL SAFETY REQUI REMENTS ARE MET." 

In fulfilling this required duty, there are ten basic tasks that must be performed. These are 
summarized as follows: 

1. Activate control area using barriers and warning devices. 

2. Remove non-essential personnel from the control area. 

3. Pre-task briefing of special procedures. 

4. Verify that communication, safety devices, safety equipment, hazard detection 
devices, etc., are available and operable. 

5. Verify that all support personnel are standing by and that the support is 
maintained during hazardous operation. 
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6. Maintain strict compliance with all safety criteria, procedures, checklists as required 
during the task. This includes clothing and equipment. 

7. Verify that the work area housekeeping is in order. 

8. Verify personnel have knowledge of specific procedures which are required if a 
mishap occurs. 

9. Announce the start/stop of operations and the proper release of all support 
personnel. 

10. Call a "Hold" or "No Go" if conditions exist that are unsafe. 

Scout procedures and safety requirements have provided for a highly safe and successful program 
over the past 16 years. These same procedures and safety requirements, modified to meet the Space 
Transportation System (STS) Program requirements and the Eastern Test Range requirements should 
perform satisfactorily when using the Scout vehicle as a payload on the STS. 

4.2.2 Minuteman (MM) . - The Boeing facility at Hill AFB, Ogden, Utah, was visited to review 
the procedures used during processing of the three MM solid rocket motors which are DOT Class B, 
Military Class 2. The safety procedures, such as caution and warning notes, are an integral part of 
the Boeing procedural type documents. Since the solid rocket motors are delivered fully assembled, 
e.g., nozzle and igniter installed, guidance propulsion system installed, safe/arm and arm devices 
installed, the safety requirements are minimal except in cases where open grain conditions may be 
required. A document which compliments the procedural document is the Integrated Record System 
Operation (I RSO) document which is the quality type check-off of the procedural steps. 

The main procedural safety consideration is the system "ground" which must be installed 
at all times and interconnected between the transporter motor-cradle and assembly building rail. 
Other safety requirements take into consideration the proper setting of transporter brakes, maximum 
wind allowable for motor transfer and temperature limits. Additional standard ordnance safety 
precautions are taken when the ordnance type items are installed in the transition sections. These 
requirements are grounding of components, conductive work surfaces, leg and wrist stats and limited 
numbers of personnel in the facility during hazardous operations. All electrical checks of the vehicle 
systems are performed remotely from a blockhouse which is integral with the assembly building. 

Facility safety items include quick release escape doors, soft panel escape walls and a large 
impaler. The impaler is located at the forward dome end of the third stage motor. If the motors 
are inadvertently ignited the impaler will penetrate the third stage motor and destroy the forward 
propulsive capability. This system was tested during the early stages of the program to demonstrate 
safety, reference 12. 

The Scout safety requirements must be more severe than those for the Minuteman program 
because of an open propellant grain condition when the solid rocket igniters and the Antares II 
nozzle are installed. Otherwise, the Minuteman impaler GSE was the only safety device utilized 
which is of basic difference from the Scout system. MM test flight operations are performed under 
the basic Air Force documents (SAMTECM 127-1, Range Safety Manual), reference 8, and Launch 
Complex Safety Operating Procedures, reference 13, used at Vandenberg AFB (VAFB) on the 
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Scout program. When a IVIM vehicle is launched from VAFB, the Minuteman System Safety outlined 
in 1STRADM 127-200, Amendment 1, reference 9, is applicable. These requirements are of similar 
nature to the Scout launch vehicle requirements which were discussed in paragraph 4.2.1. 

4.2.3 Delta Program . — The Delta launch vehicle is launched from the Western and Eastern Test 
Ranges. The Solid Rocket Field Handling Manual, reference 14, and Launch Preparation Document, 
reference 15, for the spacecraft solid rocket, TE-M-364-4, were reviewed for safety considerations. 

4.2.3.1 Receiving and inspection: The Field Handling Receiving and Inspection Document, 
reference 14, is used at the launch site for receiving and inspection. This document was prepared by 
the manufacturer, Thiokol Corp,, Elkton Division and it contains in Section 3.0 a safety summary. 

This summary specifies that the composite propellant solid rocket motor is Department of T rans- 
portation. Class B and military class 2. It is noted that there are basically three areas where hazardous 
conditions can exist during handling, storage, and inspection of the TE-M-364-4 rocket motor. These 
areas are generally common to all solid rocket motors and are as follows: (1) thin sections of 
propellant which are friction and impact sensitive, (2) propellant temperature sensitivity and (3) 
Induced static electricity or stray current. 

The basic composite propellant system is classified non-detonatable and insensitive to shock; 
however, thin sections of propellant are sensitive to friction and impact. This is especially true 
around areas with threaded surfaces such as the igniter port threads. 

It Is stated that the most likely cause of an accidental ignition is exposure to temperatures 
in excess of 250°F. Instantaneous auto-ignition is said to occur at temperatures above 500°F but 
propellant decomposition and subsequent auto-ignition may occur at lower temperatures. 

To prevent static electricity around the motor special precautions are taken to have the system 
always grounded to the surroundings. To prevent stray electrical current in the pyrogen initiators, 
shorting plugs are used, and to prevent inadvertent ignition of the pyrogen from the initiators, a safe/ 
arm unit is utilized. The safe/arm unit is the only safety feature used on this rocket motor which is 
different from Scout. 

4.2.3.2 Launch preparation document: The Launch Preparation Document, Teference 15, 

Is a typical document used by McDonnell Douglas for spacecraft upper stage buildup and erection. 

This document is similar to the standard operating procedures used on the Scout program. The 
procedure is prepared to meet the range requirements as outlined in AFETRM 127-1, reference 16, 
and KM I 1710.1 B/SF, reference 17, and are supplemented by program safety manuals and plans. 

Task 3 of the Launch Preparation Document covers the third stage motor receiving inspection 
and leak check before vehicle assembly. In this task a safety requirements checklist. Figure 4-1 

is provided to clearly make known the unsafe conditions which occur during the processing per Task 
3. The exterior of the procedure package and the applicable tasks are noted on the first page with a 
note notifying the operator that the procedure or task contains hazardous operations. The task also 
contains a list of safety requirements such as safety hazards, safety equipment, and safety rules/ 
regulations. Step 1 of Task 3 is safety verification. The check-off is to verify that all safety rules and 
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SAFETY REQUIREMENTS CHECKLIST 


1 


CONDITIONS 

CONDITIONS 

EXIST 

SAFETY REQUIREMENTS 
REFERENCES a REMARKS 


NO 

YES 

OXYGEN RICH ATMOSPHERE 

X 



OASEOUS oxygen OPERATIONS 

X 



UIQUID OXYGEN OPERATIONS 

X 



HANQUING I.H2(-N2 FLUORINE Oft OTHER HAZARDOUS 
GASES OR LIQUiOS 

X 



EXPLOSIVE DCVICES-HANDLING . INSTALLING. 
CONNECTING. ETC 

X 



centrifuge TESTING-HIGH speed, live GRAIN, 
eiO-TECH IMUMANI 

X 



entering hi/lo temperature chambers 
IFOR inspection, ETC ) 

X 



HIGH OH LOW PRESSURES 

{HYDRAULIC PNEUMATIC SYS. BURST TESTS, ETC.) 


X 

2250 PSIG GN2 

POTENTIAL CORONA OR ARC-OVER IN COMBUSTIBLE 
AREA OR ATMOSPHERE 

X 



POTENTIAL VOLTAGE OH CURRENT HAZARDS 

X 



PROPELLANTS 


X 

SOLID PROPELLANT MOTOR 

NUCLEAH RADIATION MATERIALS OR EQUIPMENT 

X 



TOXIC OR FLAMMABLE 

X 



eUECTROSTATIC HAZARDS 

X 



ELECTROMAGNETIC OR RF RADIATION 

X 



1 OTHER 


X 

THIRD STAGE MOTOR 


note: no hazardous conditions except those specified above wu_i_ exist in this test activity 


SAFETY MONITOR RECORD 


SIGNATURE OF MONITORING 

safety engineer 

DATE 


SAFETY MONITOR*S 
SIGNATURE 

DATE 


DEI-COATION 
AUTHORIZED BY 

DATE 


UAUNCH 

OPERATIONS 

GATE 


FIGURE 4-1. - SAFETY REQUIREMENTS CHECKLIST 
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regulations have been complied with before beginning work on the subsequent steps. Warning and 
caution notes are used throughout the procedure to gain the attention of the operator. The basic 
safety considerations utilized in the handling of the motor are the assurance of a good ground of all 
parts during phases of processing, prevention of static electricity from individuals and protection 
against dropping or impacting the motor. Generally the safety precautions utilized by the Scout 
program are similar to the Delta program. However, the format and requirements in the Delta 
procedures appear to match the requirement in reference 16, where the Scout procedures are designed 
to meet the Western Test Range requirements. 

4.2.4 Poseidon Program. - The Poseidon first stage solid propellant motor is a DOT Class B, 
Military Class 2, and the second stage solid propellant motor is a DOT Class A, Military Class 7. The 
solid rocket motors are delivered with the nozzle and igniter installed and open grain configuration is 
present only during internal pressure checks or during unusual operations that require removal of the 
igniter or nozzle. Since electrical squibs are not installed in the type igniter utilized, there is minimum 
hazard from inadvertent igniter activation throughout processing. 

The program uses basically two types of procedures for processing the solid rockets, Ordnance 
Procedures and Processing Work Segments; however, there are Ordnance Data Procedures used at 
dock side and in the fleet. The Ordnance Procedures (OP), such as NAVORD OP 3667 consist of 
Processing Work Sections. These sections contain all the detail procedures, cautions, warnings and 
notes which are required to perform a given task on all types of various components which also 
includes items other than ordnance. These OPs are used to train personnel in all tasks and safety 
requirements for vehicle processing. The Processing Work Segments (PWS) are written to process 

vehicle in task segments. These PWSs are written from the information in the OPs but in a manner 
which requires that the technician be knowledgeable and well-trained in the Processing Work Section 
of the OPs. However, the PWSs include warnings, cautions and notes to draw attention to various 
areas of tasks being performed. The PWSs are also written to show that the technician has task buy- 
off requirements and also the inspector has audit and buy-off requirements. A good feature of this 
system is the requirement for a roving inspector. This inspector checks at random the completed 
work task as well as the Processing Completion Report which is the quality type check-off of the 
procedural steps. 

The main procedural safety consideration is the system 'ground' which is installed at all times 
during transportation, storage, receiving and processing. Other safety features include conductive 
floors In processing area, leg and wrist stats, soft roof panels, safety warning circuit on the door latches 
leading to the radiographic inspection room, insulation links in cranes or hoists to prevent RFt and 
EMI transfer, limitation to a single hazard operation in an area at a given time and limited number of 
personnel present during a hazardous operation. Additionally a good quality assurance program is 
used to provide for regular inspection of test equipment, cranes and hoists. 

In comparison with the Scout system, the main difference in the processing lies in the proce- 
dures. The Poseidon program has the Processing Work Sections and Processing Work Segments. The 
Scout program uses Standard Operating Procedures which combine the two documents of the Poseidon 
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program. It should be noted that the Poseidon program Is in the process of changing to the single 
procedure approach; however, no accidents have occurred to cause this change. Also, the Poseidon 
program uses pink colored inserts to promote attention to recent procedure changes. 

4.2.5 Eastern Test Range Requirements . — Cape Kennedy Air Force Station (CKAFS) has 
contained within its confines the launch complexes, explosive safe areas, and missile and spacecraft 
assembly and checkout buildings. Therefore, the Air Force has the responsibility for the overall 
safety operations and has established safety requirements to be followed at CKAFS. The safety of 
NASA operations at the range is ultimately the responsibility of the Director, Kennedy Space Center 
(KSC). Safety policies and regulations governing launch operations have been established by KSC. 
However, NASA operations in AFETR areas are performed in compliance with the AFETR safety 
regulations. Hazardous operations at the range must have prior approval from the KSC and AFETR 
safety groups. The basic restraining regulations which the launch vehicle configuration and opera- 
tions must meet at the KSC or AFETR are the following, respectively: (a) KSC Safety Program with 
Attachments, KSC General Safety Plan, KMI 1710 1B/SF, reference 17; (b) Range Safety Manual, 
AFETR Manual (AFETRM) 127-1, reference 16. 

4.2.5. 1 AFETRM 127-1 Safety requirements: In this document it is specified that all 
hazardous missile/space vehicle systems must be designed, tested, operated and approved in accordance 
with requirements set forth in chapters 3 and 5. Chapter 3 outlines the prelaunch and abort opera- 
tions and the required Range approvals. Chapter 5 outlines the missile operations requirements that 
are imposed on the Range User by Range Safety. These two chapters are the most important from 
the standpoint of hazardous operations of solid rocket motors, liquid propellants, pressurized systems 
and ordnance items. 

4. 2. 5.1.1 AFETRM 127-1 Chapter 3 - A Missile Systems Prelaunch Safety Approval (MSPSA) 
document is required before any hazardous missile/space vehicle operations are performed at the 
AFETR. Formal approval for operations will not be given until the Missile System Prelaunch Safety 
Package is approved. This safety package must contain specified data on propulsion, pressurization, 
ordnance, toxic materials, electrical and when used, radioactive materials. When this data on hazardous 
systems has been presented and approved by the required launch site Safety organizations, vehicle and 
equipment components and their interfaces with other systems will not be modified without prior 
approval by the Missile Safety Branch, AFETR Safety Office (AFETR/SEN). All changes to approved 
hazardous procedures also require prior approval by AFETR/SEN. 

System safety per MIL-STD-882, reference 18, is mandatory for alt departments and agencies 
of the Department of Defense. This document outlines the concept and defines the System Safety 
as “the optimum degree of safety within the constraints of operational effectiveness, time and cost, 
attained through specific application of system safety management and engineering principles 
throughout all phases of a system's life cycle." This MIL-STD-882 approach to system safety is 
recommended to non-military users. Preliminary hazard analyses of the system are performed to 
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identify hazards and inherent risks. This subject is discussed further in Section 6.0 Preliminary 
Hazard Analysis of Rocket Systems for Shuttle Payload. 

System design and requirements must be considered in any acceptable System Safety Plan. 

The referenced document should be reviewed for further details on this subject. 

4.2. 5. 1.2 AFETRM 127-1 Chapter 5 — Operation requirements are levied on the Range User 
by Range Safety. Specifically included in the requirements are hazardous operations procedures. 
Those operations which are classified hazardous pertain to such items as ordnance materials, missile 
propellants and pressures over 500 psi. Procedures for hazardous operations must be written In a 
clear and concise manner so that people will understand them in the clearest and most logical manner 
in order that each step will be performed safely. The following information is required in all operating 
procedures: 

(a) Title page with all approval signatures and dates 

(b) The purpose with brief discussions of the task, operation, test or 
checkout and normal schedule in relation to launch 

(c) A short warning or caution note must identify the hazardous item, material and/ 
or operation. A specific note must appear before the hazardous operation and 
general caution and/or warning notes must be Included in the preface. Hazardous 
configuration of the system before and after the operation must be defined 

(d) Listing of reference documents 

(e) A list of required tools 

(f) The location where the operation or the system is to be performed 
and the location of the system at all times 

(g) A listing by title of the required personnel for operations 

(h) Pad Safety witness requirements must be stated in preface. 

Once again the detailed safety requirements to be adhered to during hazardous operations are 
numerous. Further information on these requirements can be found In the reference document. 

4.2. 5.2 KMI 1718.1B/SF KSC General Safety Plan: This document provides guidelines and 
assigns the responsibilities for the implementation of the Kennedy Space Center Safety Program and 
Safety Plan. Major safety problem areas are defined and the controls, procedures and plans are 
specified to minimize safety hazards. The KSC Safety Program requires the following items to be 
performed: 

(a) Develop greater safety controls, procedures, and standards for specific areas 

(b) Develop safety operating procedures to be utilized by operational personnel 
in hazardous operations 

(c) Develop safety standards and criteria for the design and fabrication of 

equipment and facilities ^ 

(d) Develop accident investigation and reporting procedures 

(e) Evaluate accidents and injuries for cause 
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(f) Plan, train and promote activities to improve the level of safety performance 

(g) Create safety committees to insure the most technically qualified personnel will 
evaluate hazards and recommend corrective action. 

Attachment A to KMI 1710.1B/SF provides the specifics of the KSC General Safety Plan, 
and NASA contractors must follow the requirements of this document when operating at the Range. 
However, for this study several chapters are of special interest since they pertain to hazardous 

operations as follows: 

(a) Chapter 4 - Propellant Safety 

(b) Chapter 5 — Ordnance and Explosive Safety 

(c) Chapter 6 - Pressure Systems 

(d) Chapter 8 - Operation Safety 

The one common factor underlying the safety operations in each of these chapters is the 
preparation and enforcement of explicit safety procedures. This is further stated m Chapter 8 as 

follows: 

Detailed operating procedures will be used for both hazardous 
and non-hazardous operations. Adequate procedures promote 
safety by ensuring that operations are performed completely 
and in a planned sequence. Operating procedures will be pro- 
cessed in accordance with KMI 1710.13. 

KMI 17 10.13, reference 19, defines Technical Operating Procedure (TOP) as any document 
which identifies/authorizes work to be done and provides detailed instructions for its accomplishment. 
TOP'S are divided into Category I or 1 1 depending upon the type of operation to be performed as 
follows: 

Category I TOPs: Documents which provide detailed instructions for 
verifying functional operation of Ground Support Equipment (GSE) 
and procedures which provide detailed instructions for operational 
checkout, servicing, handling, and transporting space vehicle or space 
vehicle components during prelaunch and launch operations. Repetitive 
hazardous and nonhazardous operations use Category I TOPs. Test and 
Checkout Procedures (TCPs) are examples of Category 1 TOPs. 

Category 1 1 TOPs: Documents which authorize work, provide engineering 
instructions, establish a method of work control. This type procedure is 
usually written for a "one-time" operation to perform special tests or 
authorize temporary installations, removals, or replacements. It may be 
used for "one-time" hazardous operations and for repetitive nonhazardous 
tasks when the work is of a limited scope which does not economically justify 
preparation of a Category I TOP. 
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Each hazardous Category I TOP wilt Include a safety requirement section that meets the 
following criteria: 

1. The specific hazard in the procedure must be identified 

2. Required safety equipment for each hazard must be identified 

3. Safety rules and regulations unique for each hazardous operation 
must be specified. 

Each Category I TOP which contains hazardous operations must be identified on the front 
cover with red letters at least 3/16” high as follows: 

"THIS PROCEDURE CONTAINS HAZARDOUS OPERATIONS” 

Each sequence, paragraph or section will be identified by either (a) Letter 'H' in margin; 

(b) Stripe through hazardous portions or (c) Warning or caution notes preceding any hazardous 
operational step. Category 1 1 TOPs must be identified by a statement, “THIS (IS) (IS NOT) A 
HAZARDOUS PROCEDURE” with the approving organization signature and date. The processing 
channels for Category I and II TOPs, except unmanned launch operation (ULO) TOPs, will be pro- 
cessed as shown in Figures 4-2 and 4-3. TOPs for unmanned launch operations (ULO) submit 
procedures for approval through a member of the Safety Office Staff Representative (SOSR). 

The member is co-located with the ULO. The Scout Program is a ULO and the standard operating 
procedures now in use were not required to be processed through the manned launch operation 
channels at AFETR or KSC Safety Office. 

4.2.6 Space Transportation System (STS) 

4.2.6. 1 Introduction: NASA Johnson Space Center (JSC) has prepared a safety document, 
Safety Policy and Requirements for Payloads Using the National Space Transportation System, 
reference 20, whose aim is to establish a set of minimum safety requirements for payload developers. 
These safety requirements aid in determining if the payload is safe to carry on the STS but yet 
permits flexibility In the verification options and levels. The safety policy for the STS user should 
contain those requirements that will logically protect flight and ground personnel, the public 
property, environment, elements of the STS and one payload from another. 

4. 2. 6. 2 Safety requirements: The basic safety requirements that are required in a payload 
user's program and for technical design considerations are as follows: 

(a) Hazard Analysis 

(b) Hazard Classification Levels 

(c) Hazard Reduction Procedure and Hazard Control Actions 

(d) Safety Assessment Reviews 

(e) Safety Compliance Data Packages 

(f) Accident/Incident/Mission Failure Investigation and Reporting 

(g) Radioactive Systems Data 

(h) Design and Operational Requirements 
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FIGURE 4-2. - CATEGORY 1 TOP SAFETY REVIEW PLAN 






AFETR 
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FIGURE 4-3. -CATEGORY II TOP SAFETY REVIEW PLAN 






4.2.6.2.1 Hazard analysis, classification and control - At the present, it is a requirement that 
the STS User Agency will systematically analyze his payload for hazardous systems. Sources of 
hazards may be the environment, personnel error, design characteristics, operational necessity, pro- 
cedural deficiencies or hardware malfunctions. NASA JSC recommends that the analysis of hazard 
sources should be conducted early in the payload development phase so that status of corrective 
actions to eliminate the hazards can be reviewed at each program design review. The hazard sources 
must ultimately be classified into uncontrolled and controlled classes. In the natural course of events, 
it is expected that ail hazard sources will be eliminated or controlled. The control of hazards will be 
provided by the following: 

(a) Design Features 

(b) Safety Devices 

(c) Warning Devices 

(d) Special Procedures 

Residual hazards shall be identified and justification for acceptance provided, together with proce- 
dures to avoid the hazardous conditions. The system safety approach in reference 20, is specifically 
outlined in the NASA System Safety Manual, reference 21, and is in consonance with the requirements 
set forth in Chapter 3 of the NASA Safety Manual, reference 22. 

4.2.6.2.2 Safety reviews - The general purpose of the safety review is to assess the compliance 
with safety requirements and the elimination and/or prevention of hazardous sources in the system. 
With this viewpoint the Safety Policy and Requirements document prepared by NASA JSC presents 
requirements which are directed toward a new payload which will be designed and developed from the 
beginning. It is believed that this is shown by the requirement that safety reviews will be accomplished 
progressively on individual payload elements (black-box level) prior to acceptance by and shipment 

to a spacecraft integrator and again on the complete spacecraft prior to acceptance and shipment to 
the launch area for integration to the STS. It is required that each level of organization will prepare 
and present a Certificate of Safety Compliance and that the responsibility for presenting the Safety 
Compliance moves up the approval ladder in the same way that the ^^next assembly is moving up. 
Since the NASA Scout vehicle is an operational launch system with an extensive history, some 
deviation from these requirements will be required. The general approach for obtaining approval of 
deviations is through the waiver system. To avoid reversals on granting of waivers by the final payload 
acceptance authority, waiver requests shouldije provided at the time the deviation requirement is 
generated. 

4. 2. 6. 2. 3 Safety Compliance and Range Safety (SCRS) — Items (e) through (h) of the above 
paragraph 4. 2.6.2, Safety Requirements, are basically those required by the Eastern Test Range as 
presented in AFETRM 127-1, reference 16. Therefore, the preparation of the safety compliance 
data and range safety package as required by the range will suffice for the STS program. However, 
of special importance in the SCRS document is the requirement for procedures covering hazardous 
operations. NASA documents, references 19, 23 and 24 must be considered when preparing the 
required procedures. Item (h). Design and Operational Requirements, requires special considerations 
by the STS user agency. 
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Some of these considerations are summarized as follows: 

(a) Payload generated hazards must be minimized at all times, especially 
during Orbiter landing and post-landing operations. The design and 
operation shall not Impose restrictions on normal or contingent Space 
Shuttle Operations in which safety of the STS or crew may be affected. 

(b) A safe interface between user payload, STS and GSE shall be provided. 

A hazard shall not result from any single procedural error and at least 
two procedural operations must be performed before initiation of 
safety-critical functions. 

(c) Payload data which is critical to safety shall be provided by redundant 
transmittal. A possible requirement of the system is the provision for 
remote safeing commands from the Orbiter. Safety-critical data or 
control functions must be capable of being tested from the Orbiter, 

Spacelab, or ground where applicable. 

(d) Hazardous materials shall not be released into Orbiter payload bay. 

All liquid propellants and pressurized systems shall be dumped overboard 
during an abort unless proven safe. 

(e) Components or substances which are hazardous because of incompatible 
materials, electrical potential differences or chemical incompatibility 
shall be separated to the maximum extent possible. 

(f) Flame propagation paths and ignition sources shall be prevented to the 
maximum extent possible where flammable materials are used. 

(g) Structural failure of payload mounting or support bracketry due to 
stress-corrosion shall be prevented. 

(h) Materials which produce significant odors or toxic out-gassing shall be 
avoided in manned pressurized compartments. Payload components 
carried in the Orbiter cabin shall be designed to NHB 8060.1 A. 

(i) Pyrotechnic subsystems and devices shall meet safety provisions of JSC 
08060, Spaee Shuttle System Pyrotechnic Specification. 

(i) Pressure Vessel Safety Standard NSS HP 1740.1 or other approved documents. 

(k) Safety equipment shall be designed and safety procedures established to 
minimize risk and control hazards on the ground and in flight. 

(l) Emergency or backout procedures shall be developed for payloads during 
ground and flight anomalies. 

(m) Destruct systems shall not be used unless a waiver is granted. 

(n) Inadvertent operation of propulsion systems shall be prevented by design. 

Main engine firing and stage separation, where inadvertent operation 
results in a catastrophic condition, will require three (3) failures or operator 
errors for inadvertent operation. 

(o) Retrievable payloads shall include provisions to permit preretrieval safeing 
to be verified by the Orbiter and Ground Station prior to retrieval. 

(p) Safety-critical payload elements shall be designed or protection provided 

to preclude hazards to the ground and flight crew in case of lightning strikes. 



4.3 Handling Specifications 


As was noted in discussing the safety procedures, there are three environments considered 
to be hazardous when handling solid rocket motors. It is standard procedure for the handling 
specifications to provide precautions to prevent inducement of these hazardous conditions. These 
hazardous conditions cover the following environments: 

(a) Impact, shock and friction 

(b) Static or stray electrical energy 

(c) Excessive temperatures. 

The most common approach to hazards assessment has been sensitivity testing of subscale samples 
to establish the tendency of a material to initiate or explode. The data generated by sensitivity 
testing are usually abstract and the results expressed in such terms as the 50% probability of initiation 
or explosion. From data such as this, one is able to make a conclusive statement such as , 'A' 
is more sensitive than 'B'. However, one cannot conclude that 'A' or 'B' constitute a hazard in any 
given situation. The historical approach has been that 'A' is some standard explosive such as TNT, 
RDX, or PETN and that the sensitivity test results are based on some given uniform specification 
sample and test equipment. Subsequently, with historical data on full scale handling, transportation, 
field check-out, launch, motor fallback to pad, cook-off test, drop tests, detonation shock sensitivity, 
projectile impact, and other similar tests, a historical confidence for 'normal', and to some degree, 
'abnormal' rocket motor handling has developed. Since It is too expensive to purchase full scale 
solid rockets to perform all these type tests on a new motor design, solid rocket motor users have 
had to rely on hazard qualification by subscale tests or similarity to other previous full scale tests. 

Due to the lack of knowledge on the full hazard characterization of each unique solid propel lant- 
liner-motor case-igniter system the industry has operated around this deficiency by using safety and 
handling criteria to preclude hazardous conditions. Motor testing and classification for transportation 
and storage have been presented in Section 3.0. 

4.3.1 Impact, Shock and Friction . - If a solid rocket motor is Impacted due to being dropped 
or projectile impingement-penetration, the kinetic energy must be transformed and transferred in 
keeping with the law of conservation of energy. This energy is dissipated through the phenomenon 
of shock, friction, and permanent deformation. 

Friction can occur in at least two modes, the first mode is the friction generated at the 
projectile and propellant interface upon penetration as well as the friction which occurs between the 
damaged case (liner)-propellant interface. The second mode is the interface movement between 
particles in the propellant due to a shearing motion. As one can readily ascertain, the severity of 
these friction modes is different for each unique solid rocket. The propellant modulus of elasticity, 
solids loading, particle size, oxidizer type, case liner material and thickness, and case material all have 
their effect on the dissipation of the energy. If the magnitude of the energy to be dissipated is of low 
order, it will not trigger the release of the propellant potential energy; therefore, a safe condition 
exists. 


30 



Shock loads during handling are induced into the rocket motor in at least two ways. The 
first occurs when the motor is dropped and the second occurs when a projectile contacts the motor 
surface. Shock loads also are induced from one propellant particle to the next when the propellant 
is sheared by projectile penetration. 

Friction and normally shock are the result of some form of Impact. Impact due to dropping 
is the most prevalent environment during normal handling and processing. Since it is so difficult 
to quantify the hazardous threshold of impact, the handling manuals usually provide a warning on 
impact sensitivity as follows: 

(a) The propellant is classified non-detonatable and insensitive to shock 

(b) Thin sections or films of propellant are sensitive to friction and impact. 

4.3.2 Static or Stray Electrical Energy. — When handling or working around electro-explosive 
devices, flammables or explosives and solid rocket propellants, precautions are required to prevent 
stray electrical currents from entering the system. Electrical current can be induced into the system 
by static electricity, electrical equipment, radio frequency energy, lightning, or electrical system mal- 
functions. These electrical sources are basically divided into two ignition modes: (a) ignition through 
electrical squibs, and (b) ignition of the fuel (solid propellant or atmosphere). During vehicle build-up 
and solid rocket motor handling, these two ignition modes are eliminated by the grounding of systems; 
personnel wearing conductive shoes, and leg and wrist stats, as required; quality control calibration 
and testing of electrical equipment; non-spark producing tools and shorting caps on electrical 
squibs; squibs not installed until all vehicle checks completed; no work on hazardous operations in 
area during electrical storms; or RF transmitters turned off during hazardous operations. When 
required, handling manuals specify various combinations of the above safety procedures. 

4.3.3 Temperatures. - During normal handling operations temperature is generally not a 
problem. Auto-ignition temperatures are usually above 250° F (except for long term exposure) and 
generally around 400-500°F and are a function of time exposure. Procedures usually give temperature 
limits of motors from the standpoint of preventing damage. However, any operation which could 
produce a high temperature hot spot would be considered a hazardous operation or condition. 


4.4 Hazardous Incidents and Results 

It is rather difficult to obtain data on hazardous incidents which have or may have occurred 
on various programs. This could be due to the following reasons. 

(a) A reportable incident is defined as one which requires a report to be 
submitted under DOT regulations that require evacuation of an area 
or similar protective measures to be taken. Therefore many incidents 
are not of reportable nature. 
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(b) Reports of incidents are not common knowledge on a program and a request 

can be answered easily by saying "no incidents", "I'm not aware of any problems", 
or "that data is so old I don't know where it is stored". 

4.4.1 General . — References 25 and 26 present summaries of accidents/incidents which 
occurred during the manned space programs from 1963 through 1971. Reference 25 covers 
accidents/incidents for the time period of 1961-1969 and represents the review of 10,000 case 
documents with the selection of a total of 508 summaries. Reference 26 covers the time period 
of 1970-1971 and represents the review of 5000 case documents and the selection of an additional 
223 summaries for a total of 732 cases to cover years 1961-1971. Figure 4-4 shows the percentage 
distribution of the accidents/incidents by systems. As shown the ordnance systems accounted for 
only 2 percent; propulsion systems, 6 percent; fuel/propellant systems, 10 percent; pressure systems, 

19 percent; and transport/handling systems, 12 percent. These systems accounted for about 50 
percent of all occurrences. Figure 4-5 shows the variation of accidents/incidents by program activity. 
As shown, operational test and checkout accounted for the largest percentage, 45% and ^condly 
manufacturing, 34%. Operational test and checkout includes all tests of assembled vehicles and all 
testing at field sites, including integrated tests and pre-launch checkout. Manufacturing is classified 
as functional checkout of systems, subsystems or components. These accidents/incidents by causes 
are further broken down by software and hardware deficiencies. Figure 4-6. The percentages shown 
are based on the total cases represented in each class of accidents/incidents causes in relation to the 
total number, 732, of case summaries. As shown, deficiencies in procedures and work control 
represented the two highest classes in software, and design deficiencies stand out as the largest contri- 
butor by far in hardware. 

From these data it can be readily determined that for our consideration in this study accidents/ 
incidents occurred mostly during operational test and checkout of pressure systems, fuel propellant 
systems, transportation/handling systems and propulsion systems which were caused by either 
procedural or design deficiencies. 

Design deficiency was defined in reference 25 and 26 as any design specification inadequacy, 
resulting in deficient hardware which contributed to the occurrence of an accident/incident. Factors 
considered were omission of essential information, failure to specify safety devices or warnings, 
failure to determine stress/fatigue and other operational/interface factors, errors in material selection, 
or clerical errors in drawings and specifications. An example of an accident/incident in this class 
was the X-248 solid rocket motor used on the Delta Program which had a design deficiency in the 
igniter which permitted firing by static electricity when the non-conductive polyethylene cover was 
pulled down over the system. 

A procedural deficiency was defined as any case in which formal procedures contributed to 
accidents/incidents causes as a result of failure to prepare procedures, failure to follow procedures, 
deviations from procedures during a test, failure to coordinate concurrent tests, ommissions of 
essential Information in procedures, clerical errors in procedures, use of wrong procedures, or failure 
to update procedures. An example of this type accident/incident was the blowing of nitrogen and 
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fuel residue through a hydrazine engine fuel scrubber, fuel valve, catalyst bed and out the engine 
exhaust into the face of a workman. This accident was caused by the failure to follow procedures 
and the absence of safety provisions in the procedures to protect operators. 

It should be noted that the data presented on propulsion systems in references 25 and 26 
represents mostly liquid systems rather than solid propellant systems. The closest system that 
relates to solid rocket hazard accidents/incidents is the ordnance system. As shown, this represented 
only 3 percent of the distribution. Due to the similarity to the handling and safety requirements of 
solid rockets and ordnance items in general, it is believed that the 3 percent distribution is repre^n- 
tative for solid rocket motors. Due to the complexity of liquid systems versus solid rockets, it is 
believed that accidents/incidents occurrences are several magnitudes greater than that expected during 
solid system operations. However, errors which cause hazardous incidents in solid or liquid systems 
can be just as catastrophic in nature. 

4.4.2 Liquid System Incident Reports . - A summary of selected hazardous incidents obtained 
from Reference 25 and selected from existing documentation of accidents or incidents on Manned 
Space Flight programs is presented herein. 

Records reviewed in Reference 25 included existing records of NASA Hdgs., NASA field 
centers concerned with space programs and 18 contractors, associate contractors and subcontrac- 
tors on space programs. The majority of accidents/incidents selected, occurred during various phases 
of the Apollo Program with the remainder selected from other manned space programs. 

Table 4-1 presents the pertinent data related to these selected events along with the cause. 

4.4.3 Solid System Incident Reports. — A review of hazardous incidents or accidents reported 
to the DOD Explosive Safety Board (DESB) was conducted at their facility and through the explosives 
accident-incident abstracts, references 27 through 31 . Two-hundred and ten (210) Incidents were 


reviewed and are categorized as follows: 
Type Incident 

Number 

Percent, % 

Propellant Processing 

128 

61 

Test Firings 

22 

11 

Curing/Temperature Cycling 

16 

8 

Transportation 

15 

7 

Storage 

9 

4 

Other — Not Relevant 

11 

5 

Other — Relevant 

9 

4 


210 

100 


As indicated by the table, 61% of the reported incidents occurred during propellant processing 
operations Including mixing (46), extruding/pressing (40), drying (8), sawing/cutting (22), stripping/ 
disassembly (5), casting (3), rolling (2), and scrape down (2). These Incidents involve conditions 
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TABLE 4-1. - SELECTED LIQUID SYSTEM INCIDENT REPORTS (REF. 25) 


Category 

Accident/Incident Description 

Causes 

Pressure 

Systems 

Booster stage burst during fuel tank leak check. The tank 
was overpressurized because pressure sensors were dis- 
connected by first shift and the second shift was not notified. 
Stage was destroyed. Seven men injured and minor damage 
to the facility. 

Failure to transfer information from one shift to another 
and lack of overall integrated test procedures for the test. 
Contributing causes were use of unqualified vent valves, 
overstressing of the stage during test installation and 
inadequate training of test conductor and crew. 


During development tests, a GH 2 test tank was overpressur- 
ized and ruptured, resulting in destruction of the tank dome 
and fatal injury to two personnel. 

Pressure relief valves were set too high. Contributing cause 
was failure to depressurize tank while working on it, and 
failure of the test conductor to be aware of activities in his 
scope of responsibility. Procedures for personnel safe 
distances during pressure tests were not followed. 

Propulsion 

Systems 

During installation of a low thrust engine for test runs, a 
small amount of hydrazine fuel found in the connecting 
fuel line was attempted to be purged. Failure to close-off 
the engine valve prior to purging the GN 2 permitted 30 psig 
GN 2 to be forced through the fuel scrubber, the engine valve, 
catalyst bed, and out the engine exhaust. Fuel residue and a 
mixture of gases was blown into an employee's face causing 
considerably injury. 

Test operator's failure to follow established procedures 
which required closure of the engine valve prior to 
purging operations. Contributing cause was the absence of 
provisions and safeguards in operating procedures to protect 
operators during purging. 


During maintenance engine run-up on a space flight training 
vehicle, the fuel tank ruptured during pressurization causing 
destruction of the tank, and minor injury to two persons. 

An unauthorized high pressure source was used to pressurize 
the tank. The procedure being followed was not applicable 
to the configuration of the vehicle. 

Overpressurization resulting from erroneous pressure 
readings caused by a "sneak circuit" and a lack of pressure 
relief devices in the system. Contributing causes were 
inadequate test, quality and inspection procedures. Discipline 
and control were inadequate as evidenced by use of unauthorized 
high pressure equipment on low pressure systems and lack of 
certification of equipment operator. 

Fuel/Propeltant 

Systems 

While replacing a faulty valve in a fuel system on a facility 
engine test stand being activated, two ( 2 ) maintenance 
personnel were injured by release of nitrogen tetroxide 
under pressure. 

Maintenance crews were not adequately briefed as to hazards 
of the operation, exchange of information at shift change 
was not affected and supervision failed to ensure that pressure 
was released prior to the operation. Contributing causes were 
inadequate inspection and work control procedures. 


A propellant system exploded during a test when N 2 O 4 was 
introduced to the system due to residual cleaning fluid 
in the system (Halogenated Carbon solvents}. 

Failure to properly purge the system after using cleaning 
solvents and failure to determine the compatibility of 
solvents with N 2 O 4 . 




which will not be encountered during handling/flight on the Shuttle and hence are not relevant to 
this study. 

The second most common cause of incidents occurred during static firing. These incidents 
involve such things as premature ignition and explosion of the test article. All of the incidents reported 
would have presented no problem to the Shuttle provided that: 

(a) a well engineered firing circuit had been used 

(b) a sufficient distance between the motor and the Shuttle was obtained prior 
to ignition. 

The third type of incident involved curing and temperature cycling. Incidents reported tend 
to be unresolved but appear to be generally: 

(a) Experimental propellants which prove to be unstable 

(b) Malfunctions of the heating equipment 

Since the above incidents are related to processing problems, they do not constitute a threat to the 
Shuttle. 


The fourth type of incident occurs during transportation. In general, reported incidents tend 
to increase confidence in solid rocket motors. 

Case 1423 - Illinois - 28 November 1970 - Baggett Transportation Company 

truck collided with a passenger car (icy road). Trailer 
overturned. No explosion or fire resulted. 


Case 1425 - Charleston - 1971 - Driver left highway, ran into fuel tank at service 
N. C. station. Tank burst into flames causing a rejected Polaris 

rocket motor to detonate low order. (Polaris Facility 
reports that the motor ignited). 

Case 1433 — New — 22 July 1970 — American Farmlines Transportation Company 
Mexico truck left roadway to avoid hitting car, struck culvert. Motor 

containers scattered over highway. No explosion or fire resulted. 


Case 1445 - Indiana - 1 1 November 1970 - Truck stopped at rail crossing, struck 

by car. No explosion or fire resulted. 

Case 151 1 - Mississippi - 19 October 1969 - 8 box cars (Class B, 5 rocket motors) 

piled up going into siding. No explosion or fire resulted. 

Case 1515 - New - 4 January 1970 - Driver apparently fell asleep. Truck 

Mexico overturned. Cargo of 2 MK30 Mod 2 rocket motors spilled. 

No explosion or fire, resulted. 

Case 1518 - Kentucky - 23 October 1968 - Train derailment due to brake failure. 

Car caught fire, cause unknown, but suspected due to 

smoldering of adjacent cars. No explosion resulted but 

the motors are assumed to have burned as the result of the fire. 


Case 1521 - Texas — 13 February 1970 - Truck tire blew out and overturned 

the flatbed trailer carrying a first stage Polaris solid rocket 
in a shipping container. No explosion or fire resulted. 
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Several of these incidents involved fatalities due to the collision which occurred. One of 
the incidents (Case 1425) involved low order detonation which was caused by an external fire. 

Only in the case of the train wreck (Case 1518) is there a remote possibility that a rocket motor 
ignited as a result of the collision. 

The fifth type of Incident occurs during Storage — The cause for this class of incidents Is 
generally unknown. However, the propellants in motors stored in the Shuttle bay should be well 
qualified, so that no threat of spontaneous ignition will be present. 

The sixth type of incident is not considered relevant to the study and occurs during Pro- 
cessing, ground fires and vapor incidents. 

The seventh type of incident which is potentially relevant includes: 

(a) Radio frequency/static electricity ignition — Generally speaking, solid propellants 
will not ignite due to these causes but some initiator components may. Good 
initiator design and a mechanical safe and arm will eliminate these hazards. 

A classical example of an inadvertent ignition of a solid rocket motor from static electricity 
occurred on April 14, 1964 during checkout and assembly of an Altair X-248 at the eastern test 
range. Delta Program. It was subsequently determined that static electricity could be transmitted 
from the polyethylene plastic cover or the plastic cover of the nozzle opening to the forward dome 
of the motor and into the suppressor paddle. Mounted on the suppressor paddle was the igniter 
basket which contained the igniter pellets and the low resistance squibs. The static electricity provided 
sufficient energy to ignite the squibs. An X-248 also ignited in Tulsa, Oklahoma while suspended 
from a cable on a crane. A redesign of the igniter and the spraying of a special coating on the basket 
and paddle eliminated this problem. 

(b) External fire - External fires can ignite solid motors and can turn a problem into a 
casta strophy. 

A summary of some miscellaneous reports Involving solid rocket motors which illustrate 
some of the above types of incidents follows. 

4.4.3. 1. Polaris and Poseidon Programs: There have been a number of transportation incidents 
with the Polaris and Poseidon solid motors. One incident was the fallback of a Polaris missile 100 
feet to the water with no ignition, explosion or detonation. Also a flatbed trailer truck carrying two 
first stage Polaris motors turned over on the highway near Fort Leonard Wood, Missouri. The truck 
was traveling about 65-75 MPH and it skidded on its side for about 175 feet before coming to rest. 

The two motors were in their shipping containers and were supported inside these containers with 
air springs. There was no extensive damage to the containers and no ignition of the motors. 

There have been at least two major transportation accidents with Poseidon motors. In 1971 a 
railroad flat car containing two trailer transporters derailed in East St. Louis, Missouri. The bed came 
loose from the wheels and tilted to one side while traveling at about 10 MPH turning the vans on their 
sides on the rail bed. One van contained a first stage Class B motor and the other van contained two 
second stage Class A motors. Figure 4-7 shows the configuration of these motors after the van bodies 
were removed. The motors received some damage but no exposed propellant occurred. In 1975 a 
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railroad flat car containing two trailer transporters carrying first stage Class B motors derailed in the 
Hamelet, North Carolina railyard. These transporters also fell to their sides and the motors received 
damage but the accidents did not result in any exposed propellant and no ignition occurred. Another 
incident consisted of a complete missile which was being removed from a container liner in the vertical 
position. The missile fell about 12 inches and caused damage to the aft support ring. There were 
other minor incidents where the fiberglass cases received minor damage during handling. Indications 
are that it is not often that a motor rejection occurs. A rejection did occur as the result of an accident 
of a motor on a roller cradle which was being rolled from magazine storage. The cradle wheels hit 
the rail stops which caused the motor to tip over on the igniter-end causing case damage. No ignition 
has occurred during any Poseidon handling or transportation accidents. 

4.4.3. 2 Minuteman program: A large number of interstate and omfacility shipments of 
individual motors and assembled vehicles have been made with only six known accidents. Three 
transporter/erectors ran off the road and resulted in solid rocket damage but no ignition, explosion 
or detonation. One transporter/erector tipped over during erection with damage to the solid rockets 
but no ignition, explosion or detonation. In another case the transporter/erector fell and impacted 
on the front retracted parking wheels. Structural damage occurred but no rocket ignition, explosion 
or detonation. Also, the brakes locked on a transporter trailer and the resulting accident damaged 
two second stage solid rockets but no ignition, explosion or detonation occurred. There have been 
at least three aborted Minuteman launches at the Eastern Test Range. The third stage motors on 
flights FTM-412 and 418 fell 11600 feet and 1900 feet, respectively, to the water without any 
reaction. The third stage of FTM-422 fell 3800 feet to the ground and burned. 

4.4.3.3 Scout program: In 1963 vehicle S-1 10, reference 32, experienced a nozzle failure 

on the first stage Algol solid rocket motor.! An altitude of 1260 feet had been obtained when the linear 
shape charges of the second and third stages were fired, 4.29 and 4.26 seconds flight time, respective- 
ly. The second and first stage motors landed In the marsh about 0.9 miles from the launcher and 
the upper three stages landed on or near the launch pad. The first and second stage burned with no 
explosion or detonation as did the third and fourth stage motors. The fifth stage motor broke open 
but did not ignite, explode or detonate. The first, second and fifth stage motors contained composite 
propellants while the third and fourth stage motors contained composite modified double base 
propellants. 

In July 1967 an Antares II X259 solid rocket motor was static fired in an effort to substan- 
tiate failure modes postulated due to the Scout vehicle failure S-152C. At 25 seconds after rocket 
motor ignition a linear shape charge was fired. The case was split longitudinally and propellant and 
pieces of the case were thrown as far as 300 feet. The propellant and debris continued to burn for 
about 30 minutes. This test confirmed that the linear destruct charge (prdx "" grain/ft) would 
not detonate the DOT Class A, Military (Class 7) propellant. 


4.5 Conclusions 

A solid propellant rocket system contains all the required constituents to sustain a combus- 
tion process and if certain type damage or critical flaws are present in the system, abnormal motor 
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operation, explosion/deflagration or detonation could occur during motor operation. Upon review 
of the Scout launch vehicle standard operating procedures and the Scout launch complex safety 
plan it was determined that precautions and requirements are satisfactory to prevent known hazar- 
dous situations as outlined in Western Test Range documents. There are three areas of hazardous 
environments that are covered by safety procedures. 

(a) Impact, shock and friction 

(b) Static or stray electrical energy 

(c) Excessive temperatures. 

The basic handling concern is not generally based on the hazard of explosion/deflagration or detona- 
tion of the solid rocket but the primary concern is premature ignition. Impact and shock environ- 
ments are primarily a concern from the standpoint of damage which will subsequently cause system 
failure upon normal ignition. The hazard of static or stray electrical energy is reduced or eliminated 
in a number of ways. These include the proper grounding of the system at all times, personnel 
wearing grounding devices, terminating operations during lightning, storms, terminating or reducing 
the output of RFI during the final launch sequence, using safe/arm devices on the motor igniter 
with a shielded electrical system and the use of a shunting device during the handling of all squib 
devices. Properly maintained temperature control of facilities used for solid rocket handling coupled 
with established safety and hazard prevention procedures, should eliminate the auto-ignition concern. 

In reviewing the safety requirements and practices of other programs it was determined that 
the basic hazardous situations of concern were common to the Scout launch vehicle. This was not 
unexpected since Industry safety practices. Department of Transportation and Department of Defense 
standards and launch complex safety requirements are based on the same basic standards. When 
operating out of the Kennedy Space Center the contractor must use Category I Technical Operating 
Procedures (TOPs) for repetitive hazardous and nonhazardous operations. The hazardous procedures 
must contain at least 3/16" red letters on the front cover which identifies the procedure as containing 
hazardous operations. The first page of the procedure contains a safety requirements checklist and 
required signature authorization. These two requirements are major safety attention features and are 
not utilized in the Scout standard operating procedures. 

Under the present requirements of the Space Transportation System a contractor must provide 
a detailed safety program which provides for detail safety reviews from the black box level to the 
completed payload. These safety reviews will terminate in a Safety Compliance document. This 
document with the Range Safety document is submitted to the Eastern Test Range for approval before 
operations can be performed at NASA or Air Force facilities on the Range. The standard Scout 
documents can be used to satisfy a portion of these requirements but additional effort will be 
required to satisfy these Shuttle requirements. 

In reviewing component and system incidents/accidents it was concluded that most of the 
hazardous situations were caused by either procedural or design deficiencies. Proper attention to 
these two areas throughout system design or modification will provide a high confidence level in 
system safety and vehicle processing. System safety requirements are discussed further in Section 6.0. 
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5.0 ASSESSMENT TECH NIQUES-SO LID AND LIQUID PROPULSION SYSTEMS 


5.1 Introduction 

Safety is a primary concern when handling or utilizing any solid or liquid propellant system. 
When considering solid or liquid propellant rockets as propulsion systems of payloads for the Space 
Transportation System, it is desirable to have a hazard assessment technique. This technique would 
identify threshold hazard parameters, such as impact velocity, and the effect of the hazard if it 
occurred, such as overpressure. 

A thorough survey of available literature, data, test reports, etc., was conducted in an effort 
to define the thresholds required to create a hazardous situation as well as to define the possible 
consequences of the situation. A review of available literature yielded considerable information con- 
cerning liquid propulsion system hazards but somewhat limited information concerning solid rocket 
motor hazards. The most definitive source of information concerning these systems and the hazards 
associated with them are the test reports on projects Pyro and Sophy respectively. 

Project Sophy dealt exclusively with composite propellants. Data on composite-modified dou- 
ble base propellants is available in the form of test reports performed on missile systems and motors as 
well as private industry research and development reports. This data is not as well defined in terms of 
varying parameters as the composite data. The literature survey failed to disclose any conclusive 
hazard evaluation method which is applicable to both composite and composite modified double 
base (CMDB) solid propellant systems. In an effort to evaluate the effects and hazards of CMDB 
propellants, much reliance has been placed on pooled test data and results. 

Several valuable sources are available to aid in the assessment of hazards of liquid propellants. 
These works contain studies, theoretical analyses, and detailed graphs and charts pertaining to the 
various parameters involved. A discussion of techniques and a list of these references is provided. 

Therefore, this task provides generalized boundary limits for specific hazard threshold and 
effect parameters rather than providing specific methods of analysis. 

The threshold hazard parameters investigated are: 

• Impact Velocity 

• Critical Diameter 

• Pseudocritical Geometry 

• Initiation Criterion 

The hazards effects are: 

• Peak side-on Overpressure 

• Positive Phase Impulse 

• TNT Equivalency/Terminal Yield 

• Fireball/Firebrand Effects 

• Fragmentation 
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5.2 Findings from Propellant Test Programs 


Aside from solid motor hazard classification tests on specific motors as performed for the 
Defense Explosive Safety Board (DESB), there was little data obtained under controlled conditions 
prior to 1965. Since that time several test programs have been conducted in order to obtain 
experimental data which could be used in determining the credible damage from assembled propul- 
sion systems. The two most extensive programs performed, (Project SOPHY and PYRO) are 
summarized here. 

5.2.1 Project Sophy. — This project was performed for the purpose of evaluating the 
explosive hazard characteristics of solid propellant rocket motors. Tests were performed at the Air 
Force Rocket Propulsion Lab in two phases — Sophy I and Sophy II. The details of these tests are 
reported in two summary reports, references 33 and 34. 

These tests were conducted with standard ANB— 3226 PBAN propellant, RDX adulterated 
and unadulterated. The tests were identified in general terms as: 

1. Critical diameter 

2. Pseudocritical geometry 

3. Sensitivity tests 

4. Propellant defects study 

Critical diameter testing of typical Military Class 2 (composite) propellant was performed and the 
critical diameter concept extended to include several propellant grain configurations. Pseudocritical 
geometry testing included solid right circular cylinders and modified cylinders approximating various 
grain patterns typical of solid motors. An empirical relationship between the cross-sectional area and 
total perimeter was identified to define critical pseudocritical geometry characteristics. 

In the tests, a degree of enrichment with RDX was used to assure mass detonation of the test 
sample. To assure detonation, the initial test specimens were detonated with an excessively large 
quantity of TNT which was much greater than the threshold for reaction. By gradual reduction of 
RDX enrichment and increasing test specimen diameter, it was possible to identify a critical diameter 
of approximately 64 inches for a composite propellant right solid circular cylinder. Additional tests 
were performed to determine the minimum shock pressure required to initiate detonation as a func- 
tion of propellant diameter. Results obtained from RDX adulterated propellants and extrapolated 
to unadulterated propellants indicated that Class 2 solid motors near their critical diameter would 
mass detonate when exposed to an overpressure of 25 kilobars (263,593 psi) or greater. 

5.2.2 Project Pyro. — Project Pyro was initiated to examine the explosive characteristics of 
hypergolic and cryogenic'prope Hants for the purpose of predicting the credible damage potential 
which can be realized from an accidental explosion. The propellants investigated were nitrogen 
tetroxide and Aerozine 50 (hypergolic), LOX/RP-1 and LOX/LH2 (cryogenic). Propellant weights 
up to about 100,000 pounds were used for the cryogenic combinations and up to 1000 pounds for 
the hypergolic combination. The two major boundary conditions selected for testing were confine- 
ment-by-missile (CBM) and confinement-by-the ground (CBGS). These were considered to be the 
two major classes of propellant interaction resulting from accidental mixing due to a failure. The 
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basic data obtained from these tests were peak-overpressure and positive-phase impulse, both as a 
function of distance from the propellant explosion. Equivalent explosive weights (determined 
separately for peak-overpressure and the positive-phase impulse) and thermal data including total 
heat flux, gas temperatures, and radiant heat flux were also obtained. Additionally, the influence 
of vehicle (or propellant tank) impact velocity on fallback, missile or vehicle geometry, tank ullage 
volume, total quantity of propellants and other factors were examined in the program and are 
discussed in detail in the final report, reference 35. 


5.3 Solid Propellant Systems 

There are two general types of solid chemical propellants presently in use; composite and 
composite modified double-base propellants (hereafter referred to as double base propellants or by 
abbreviated form CMDB). 

The composite propellants have two important ingredients, a fuel and an oxidizer, neither 
of which would burn satisfactorily without the presence of the other. Often these consist of 
crystalline, finely ground oxidizers dispersed in a fuel binder polymer matrix. Typical existing 
rocket motor propellant compositions contain (% weight) Ammonium Perchlorate (60-75%), 
aluminum (15-22%), and a binder system (12-35%). 

Double base propellants are essentially higher energy propellants containing unstable chemi- 
cal compounds, such as nitrocellulose or nitroglycerin, which are capable of combustion in the 
absence of all other material. These propellants have the oxidizer and fuel present in a single 
(colloidal) phase of plasticized nitrocellulose with the addition of various stabilizers. 

Typical existing rocket motor propellants contain blends of nitrocellulose (14-32%) and 
nitroglycerin (10-33%) and are often mixed with ammonium perchlorate (5-20%) and aluminum 
powder (17-28%) to form higher performance double base composite propellants. Additionally, 
many high performance double base propellants contain high energy additives such as HMX 
(20-26%) which increase the motor performance as well as Its sensitivity. In establishing an assess- 
ment technique of the hazard of these motors, great dependence has been placed on published 
test data relating to explosions and detonations of composite and double-base propellants. Data 
of this type is scattered and often related to unpredicted (and therefore not instrumented) missile 
system failures. Controlled tests of rocket motor propellants are very expensive due to the 
destructive nature of the test as well as the cost of the motors. The data presented in the following 
sections is based on information derived from controlled tests performed by military agencies, 
accident reports, as well as information obtained from rocket motor manufacturers. 

Due to the limited source of experimental data, it is the objective of this section to provide 
an indication of the boundary conditions and trends pertaining to hazard parameters, rather than 
specifically presenting an analysis technique. 

An attempt will be made to treat first the environmental parameters which can constitute 
a motor hazard, and then the parameters which can result from the consequences of a motor 
explosion/detonation. 
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5.3.1 Hazard Thresholds 


5.3. 1.1 Impact velocity: In addition to the usual environments arising from handling 
and storage of solid rocket motors, the possibility of inadvertent earth impact during Space 
Shuttle loading operations must be considered. This situation can arise from an equipment and/or 
operator malfunction during the hoisting of a solid rocket motor onto the Shuttle. In an effort to 
determine the thresholds of motor ignition, explosion, or detonation resulting from an impact, data 
has been compiled on various impact tests, accidents, missile fallback data, shotgun tests, and flying 
plate tests, references 7, 12, 36, 37, and 38. 

Figures 5-1 and 5-2 show the data compilation of impact velocity (Vj) as a function of scaled 
weight ^/\^1/3 foi" composite and double base propellants, respectively, (Wp) is propellant weight 
in Ibm. A subjective extrapolation between existing data points has been attempted. The lower 
line in each figure represents the boundary between an “inert" region where impact of a mass pro- 
pellant will not result in a reaction, and an "explosion/burn" region where impact could result in 
propellant burning and/or propellant break-up with propellant particles and fragments ejected. 

The upper boundary line in each figure represents the transition region where full reaction 
of the impacting propellant could take place resulting in a detonation. 

The region of most interest for rocket motor handling is the inert region where no reaction 
will take place. This region appears to be identical for both composites and double base propellants. 

It should be noted that the compilation of impact data did not account for any attenuation 
which might be present. Small scale tests such as the Shotgun Tests and some Flying Plate Tests are 
for unrestrained samples of propellant. In large missile fallback data, drop tests, etc., the rocket 
motor propellant is encased and a degree of attenuation is present due to the case and vehicle inter- 
stage structure. 

From the figures, it is possible to estimate the marginal condition at which the impact velocity 
for a specific mass of propellant becomes “critical". 

For example, from Figure 5-1 a Scout 4th stage composite rocket motor weighing approxi- 
mately 600 pounds is estimated to achieve a critical velocity of 59 ft/ sec. This velocity is equivalent 
to a free-fall height of 54 feet. Likewise, a Scout 3rd stage, composite-modified double base rocket 
motor, weighing approximately 2560 pounds, is estimated to achieve a critical velocity of 53 ft/sec, 
equivalent to a drop height of 44 feet. 

These curves are again, intended only to show generalized hazard regions and are limited by 
the small data samples that comprise them. As an extension of Figures 5-1 and 5-2 the available 
kinetic energy (1/2 MVj2) of the impacting propellant mass has been plotted on Figure 5-3 as a 
function of the propellant weight for both composite and double base propellants. The generalized 
regions of detonation, explosion/burn, and no reaction are again shown separated by extrapolated 
lines between existing data points. 
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FIGURE 5-1. — COMPOSITES: IMPACT VELOCITY VS. PROPELLANT WEIGHT 
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FIGURE 5-2. - DOUBLE BASE (CMDB): IMPACT VELOCITY VS. PROPELLANT WEIGHT 
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5.3. 1.2 Detonation sustainment-composite propellants: The ability of a solid propellant 
grain to sustain detonation has been established for composites by the testing performed by the 
Sophy project, references 33 and 34. Although the test program was limited to composites with 
PBAN binder, the concepts of critical diameter pseudocritical geometry and minimum shock 
pressure were evaluated and provide great insight as to the hazardous potential of composite 
motors in general. The findings of project Sophy can be applied to composite propellant motors 
with constituents having approximately the following compositions: 69% weight ammonium 
perchlorate (AP), 15% weight aluminum (AL), and 16% weight polybutadiene acrylic and acry- 
lonitrile binder (PBAN). The above ratios are representative of many Class 2 composite pro- 
pellants in use today. 


5.3.1. 2.1 Critical diameter (D^,) — This parameter is defined as the minimum diameter for 
solid propellant configured as a solid right cylinder which will sustain detonation. Project Sophy 
critical diameter tests were performed selecting logical configurations of solid right cylinders varying 
in diameter from 4 to 72 inches. The length to diameter ratios for all samples was four. Initially, a 
degree of enrichment with RDX was used to assure mass detonation of the sample. These Initial 
detonations were accomplished by an over-charge of TNT which was much greater than the threshold 
for reaction; thus assuring detonation if the test specimen was greater than critical diameter. By 
gradually reducing the RDX enrichment and increasing the sample diameter, it was possible to identify 
a critical diameter of approximately 64.2 inches for a composite solid cylinder near the above chemi- 
cal composition. For grains adulterated with RDX, the critical diameter relationship is shown in 
Figure 5-4 as a function of the weight fraction of RDX in the propellant. 


5.3. 1.2.2 Pseudocritical geometry {o^) - The pseudocritical geometry {o^) of a non-solid 
circular shape is defined as four times the ratio of the cross-sectional area to the total perimeter, for 
the smallest sample size that can sustain detonation. Critical geometry testing performed under 
project Sophy included solid right circular cylinders and modified cylinders approximating various 
grain patterns typical of solid motors. Internal grain configurations included circular, square, rectan- 
gular, triangular and cross-core patterns. Analysis of the experimental evidence showed that the 
pseudocritical geometry (a^,) is approximately equal to 92% of the critical diameter (D^.) of the 
material. 


4 A 




cr. sect 


= .92 D. 


Figure 5-5 shows the pseudocritical dimensions for various shapes obtained from reference 33. 


An example of calculation of the pseudocritical geometry of a composite propellant rocket 
motor is given: 

Motor: Scout 4th stage — Altair I HA 

Motor Outer Diameter (Dq): Approx. 19 inches 

Motor Core Diameter (Dj): Approx. 4.1 inches 
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Pseudocritical Geometry: 

4A _ (4) (-^ (Do2_D|2)) 


®c p 


7T (Dq + Dj) 


(192-4.i2) 

= = 14,9 in. 

^ (19 + 4.1) 

For PBAN propellant = 64.2 (ref. 34) 

PBAN = .92 = .92 (64.2 ) = 59.1 in. 


Therefore the Altair II I A has a pseudocritical geometry of 14.9 inches which is less than the 
minimum 59.1 inches required to sustain detonation. 


Since the critical diameter for sustainment of detonation of a composite propellant motor 
has been found (Project Sophy) to be in the order of 64 inches, the majority of composite solid 
rocket motors which are candidates for Space Shuttle use are relatively safe for use due to their 
subcritical size. 

This conclusion must be justified by the realization that given sufficient donor charge, a 
subcritical size rocket motor will react to the explosion with large pieces of propellant and fragments 
being ejected in the reaction. 


It should also be noted that if a composite propellant composition is adulterated with high 
energy constituents, the critical diameter will be reduced thus increasing the propellant's susceptibility 
to detonation. 


However, even though a given solid propellant motor configuration is capable of sustaining 
detonation, this does not mean that the motor will detonate. A second condition must be present, 
namely; sufficient stimulus from a given donor charge. 

5.3.1. 2.3 Initiation criterion — The tests performed during Project Sophy included the deter- 
mination of overpressures required to detonate a composite solid rocket motor. Having determined 
the threshold overpressure for detonation, a method would then exist for determining the donor 
size. The following was concluded in Project Sophy: 

The minimum shock pressure required to initiate detonation was determined as a 
function of charge diameter for three (3) RDX-adu Iterated propellants, using the 
card-gap test technique. These data were extrapolated to unadulterated propellant 
by comparing the trends, with respect to RDX content, of the minimum shock pressure 
required near the critical diameter and the minimum pressure required in the ideal- 
diameter region. From the data near the critical diameters, it is estimated that for 
unadulterated propellant the minimum shock pressure required at the critical 
diameter is 25 to 30 kbar. This estimate would be greatly Improved by acquisition 
of additional data from adulterated propellants near their critical diameters. In the 
ideal-diameter region, the data indicate that the minimum initiating pressure required 
for ANB-3226 is 8 to 10 kbar. 
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FIGURE 5-5. - PSEUDO CRITICAL DIMENSIONS OF VARIOUS SHAPES 
PERFORATED GRAINS (REF. 33) 












The ideal diameter (for mass detonation) was described as approximately 4 to 5 times the 
critical diameter thus requiring very large motor diameters to meet the condition of lower initiating 
pressure. 

Data obtained from NOL card-gap tests, reference 39, of other conventional composite 
propellants (polyurethane, polyvinyl chloride, or polysulfide rubber binder) indicated that these 
propellants could not be detonated In the subcritical diameters tested. The incident pressure in 
these tests was in the order of 100 kbars. 

5.3. 1.3 Detonation sustainment - CMBD propellants: Published data on double base pro- 
pellants is not as readily available as composite propellants. There has not been any major full scale 
testing effort of the magnitude of Project Sophy conducted to define propellant characteristics. The 
Navy has not released the latest results of testing on the cross-linked double base propellant develop- 
ment for the C4. Existing data used in this task has been obtained mainly through discussions with 
propellant manufacturers and published reports of known characteristics of CMDB propellants and 
on military test reports. In an effort to categorize the parameters applicable to double base pro- 
pellants a comparison has been made of these propellants to composite propellants based on availa- 
bility of data. 

5.3. 1.3.1 Critical Diameter - Due to the nature of double base propellants, high energy 
additives are often used in their formulations to provide higher performances. Cyclotetramethylene 
Tetranitramine (HMX) is often used as high energy additive for double base propellants as well as 
nitroglycerin (NG) and nitrocellulose (NC). Many military solid rocket motors and some NASA 
solid launch vehicles motors use HMX. The Scout third stage rocket motor (Antares MB) contains 
19.5% HMX in its formulation (CYI propellant). Figure 5-6, reference 7, shows the effect of high 
energy ingredients on critical diameter as well as explosive booster size required to detonate solid 
propellants. Although the data points for donor size and critical diameter have not been verified 

in this study the curve does show the general relationship for critical diameter with increasing 
weight fractions of high energy ingredients. The NOL card-gap test (paragraph 3.3.1.1e) is shown 
superimposed on Figure 5-6. The location corresponds with the Tetryl donor weight used to deto- 
nate the cylindrical propellant specimen tested. 

Figure 5-7 is a presentation of the critical diameter-weight fraction data and better shows 
this relationship. 

The data presented in these figures gives an indication of the relative sensitivity of double 
base propellants to an explosive donor. 

5.3. 1.3.2 Shotgun quickness test - Data generated from the T rident Motor Detonation 
Investigation Program show that the most probable cause of propellant detonation during a motor 
test is from severe propellant breakup combined with a confining environment that allows sufficient 
heat impulse and pressure increase to cause runup from deflagration to detonation, reference 40. 

A test presently used to indicate the susceptibility of the propellant to fracture into small fragments 
under high shear loads is the shotgun/relative quickness test. The shotgun quickness test (paragraph 
3.4a) is a measure of the breakup characteristics of solid propellant by determining those effects 
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FIGURE 5-6. - EFFECT OF HIGH ENERGY INGREDIENTS ON CRITICAL DIAMETER AND 
EXPLOSIVE BOOSTER SIZE REQUIRED TO DETONATE SOLID 
PROPELLANTS (fIef:?) 
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FIGURE 5-7. — CRITICAL DIAMETER VS. PERCENT WEIGHT FRACTION 



which occur as a function of impingement velocity such as sample breakup and initiation, burning, 
or explosion. The pressure rise rate in a closed bomb is a function of surface area (and therefore 
breakup), burning rate, flame temperature and gas production. However, for similar propellants, 
differences in pressure rise rate are almost entirely due to surface area (breakup). The propellant 
resistance to breakup, thus the susceptibility to conditions which may result in propellant detona- 
tion, can be compared among propellants by comparing the sample quickness as a function of impact 
velocity. 

Figure 5-8 shows a quickness-impact velocity comparison for various propellants, reference 
41 and 47. CYI and FKM are composite-modified double base (CMDB) propellants containing 19.5% 
and 26% HMX respectively. VOP, VLZ, and VPT are cross-linked double base (XLDB) propellants. 
TP-H-1123 and TP-H-1016 are composite propellants containing approximately 70% and 77% am- 
monium perchlorate respectively. A comparison of these curves shows that CMDB propellants which 
have been used over the last 10-15 years, experience considerably less damage at any given impact 
velocity than the composite or XLDB propellants formulations shown. 

5.3. 1.3.3 NOL Card Gap Test — Additional Data on propellant shock sensitivity, reference 39 
has been obtained on different types of composite and double base propellants. These results have 
also been compared with better known military explosives. The testing that was conducted is based 
on the NOL card-gap tests. Although, in these tests, conventional composites (polyurethane, poly- 
vinyl chloride, or polysulfide rubber binder) could not be detonated in the diameters tested (diameter 
tested was below critical diameter) double base propellants did detonate readily. Figure 5-9 shows the 
relative shock sensitivity (defined In terms of the number of sensitivity cards at the 50% probability 
of detonation) vs. the effects of temperature. Marked changes in temperature do not appear to induce 
comparable changes in sensitivity and such changes as do occur are generally in the expected direction, 
i.e., rising temperatures increase detonatability. Figure 5-10 taken from reference 39 and 44 shows the 
pressure pulse vs. the attenuator thickness (corresponding to the number of cards required to obtain 
50% detonation probability). Although the actual pressure required to detail a response in a given 
solid rocket configuration may vary somewhat from the indicated value, the relative sensitivity of 
various propellants can be seen. 

Superimposed on Figure 5-10 are the detonating pressure valuesfor CYI (used on Scout 3rd 
stage Antares MB) CYH, and EJC CMDB propellants, TP-H-3335 high energy composite propellant 
(21.6% HMX), and TP-H-3062 composite propellant (used on Scout 4th stage Altair IMA). The data 
for the above propellants was obtained from published NOL card-gap test reports, reference 45, 46, 
and 43 and gives an indication of the relative sensitivity of these propellants. As can be seen, the 
detonation thresholds for these present day CMBD propellants is in the order of 30 to 44 kbars. 

It should be noted that since the NOL card gap test is conducted with subscale samples which 
are subcritical for composite propellants and super-critical or near critical for CMDB propellants, the 
incident pressures reflect the higher sensitivity of CMDB propellants. 

When comparing the Incident pressure of full-scale motors, the composite propellant incident 
pressure (Project SOPHY) is lower than that of CMDB propellants. However, it should be recognized 
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Number of cards — shock sensitivity 50% probability of detonation 



59 




Incident pressure (propellant interface) ~ kbars 



Card gap distance ~ in, (m = in.x .0254) 

(psi = kbars X 14500) 
(N/m^ = psi X 6894.75) 


FIGURE 5-10. - INCIDENT PRESSURE IN CARD GAP TEST 
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that the critical diameter of the composite propellants tested is very large (62.4 in.) and that smaller 
diameter motors will not detonate; that is to say that full-scale composite propellants appear to be 
less sensitive than full-scale CMDB propellants as long as their diameters are less than critical. 

5.3.2 Hazard Effects. — Most of the material damage caused by detonation or explosion is 
due mainly— directly or indirectly— to the shock (or blast) wave which accompanies the explosion. 
Structures will suffer some damage from air blast when the overpressure In the blast wave, i.e., the 
excess over the atmospheric pressure (14.7 pounds per square inch at standard sea level conditions), 
is about 0.5 pound per square inch or more. The distance to which this overpressure level will extend 
depends on the yield or size of the explosion, and on the height of the burst. In considering the 
destructive effect of a blast wave, one of its important characteristics Is the overpressure. Classically, 
the properties which are usually defined and measured are those of the undisturbed or side-on wave 
as it propagates through the air. The peak side-on overpressure is the maximum value of the over- 
pressure at a given location generated by the undisturbed shock wave. 

5.3.2. 1 General scaling laws: Scaling laws, reference 47 used to calculate the characteristic 
properties of the blast wave from an explosion of any given energy if those for another energy are 
known. With the aid of such laws, it is possible to present data for a large range of weights in a simple 
form. 


Theoretically, a given pressure will occur at a distance from an explosion that is proportional 
to the cube root of the energy yield. Full-scale tests have shown this relationship between distance 
and energy yield to hold over a wide range of explosive weights (up to and including a megaton). 
According to this law, if d-| is the distance (or slant range) from a reference explosion of pounds 
at which a specified hydrostatic overpressure or dynamic pressure is found, then for any explosion of 
W pounds, these same pressures will occur at a distance d given by: 

d/d, = 

Cube root scaling can also be applied to arrival time of the shock front, positive phase 
duration, and impulse, with the understanding that the distances concerned are themselves scaled 
according to the cube root law. The relationships may be expressed in the form 

t d / W I d / W 

ti=dr\wj ""d H ■ di I Wj 

where t-] represents arrival time or positive phase duratipn and 1 1 is the impulse for a reference 
explosion W<|, as before, d-j and d are distances from ground zero. If W>| is taken as 1 pound, then 
the various quantities are related as follows: 

t = t-| X at a distance d = d^j X 
and 

I = I -| X at a distance d = d-| X 

Throughout the Sophy and Pyro works blast yield is expressed as percent yield, based on 
an average of pressures and impulses measured at the farthest distance from the source when compared 
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to standard reference curves, referernw 48, for TNT surface bursts (terminal yield). Hopkinson's 
blast scaling is used when comparing blast data for tests with the same propellants and failure condi- 
tions, but different mass of propellant. So, the blast parameters P (peak side-on overpressure) and 
l/w1/3 (scaled impulse) are plotted as functions of (scaled distance X), after being normalized 

by the fractional yield. 

Figure 5-11 shows the peak-overpressure as a function of ground range scale factor (X) for 
TNT as normally presented in literature, reference 2. The use of this data can be simplif ied by 
using the run-around chart in Figure 5-12. 

TNT is the base or standard to which other explosives and propellants are normally referenced, 
however, some use PETN or Tetryl as a reference. 

5.3.2.2 Peak side-on overpressure: The characteristics of pressure waves, particularly peak 
side-on overpressure and specific impulse, are used extensively on developing damage estimates from 
propellant explosions. 

A review of available overpressure data related to solid rocket motor explosions/detonations 
shows considerable scatter of data. This can generally be attributed to variable conditions leading to 
the explosion, i.e.. If the motor detonated or exploded, the location of donor charge relative to the 
acceptor, configuration of rocket motors, interstage structure spacing, type of test. Impact or donor 
charge. 


Figure 5-13 shows the peak side-on overpressure vs. ground range scale factor, X, for several 
tests. X is defined as the ground ranm (R) from the reference explosion divided by the cube root of 
the reference propellant weight (W^'^). The data shown by Figure 5-13 indicates the peak side-on 
overpressure upper limits that can be expected for typical composite or double base propellants. I n 
cases where a motor detonated, such as the project Sophy adulterated composite propellant motor, 
the overpressure recorded is the greatest. 

Rocket motors which exhibited deflagration or explosion with large pieces of burning pro- 
pellant (firebrands) and case scatter, the recorded overpressure is much less. The curve for TNT is 
shown for reference. 

5.5.2.3 Positive overpressure impulse: F igure 5- 1 4 gives the scaled positive overpressure 
impulse (yJl/3 ') as a function of ground range scale factor, X, for several solid propellant rocket 

motors. It represents the area under the positive phase of the pressure time curve. The scatter of 
data, as for overpressure, can be attributed to variable conditions. Defiagration/explosion resulting 
in propellant scatter generally results In lower impulse than a detonation. Figure 5-14 gives an 
indication of the upper limits that can be expected for typical composite or double base propellants. 
A reference curve for TNT is shown for comparison. 

5.3.2.4 TNT Equivalency: The free-air equivalent weight of a particular propellant or 
explosive is the weight of a standard explosive, e.g., TNT, required to produce a selected shock wave 
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(IM/m^ = psi X 6.8947 X 10^) 

FIGURE 5-11. - OVERPRESSURE SCALED DISTANCE PLOT SHOWING TYPICAL LEVELS 
FOR BLAST DAMAGE {REF: 2) 
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Example: 

Detonation of 30 pounds of TNT results in 
a peak overpressure of 1 5 psi at 25 feet. 


FIGURE 5-12. - PEAK OVERPRESSURE AND DISTANCE FOR TNT SURFACE BURST 




Peak side-on overpressure (P) ~ psi 
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FIGURE 5-13. - PEAK SIDE-ON OVERPRESSURE VS. SCALED GROUND RANGE 
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parameter of equal magnitude to that produced by a unit weight of the propellant or explosive in 
question. 

A given explosive may have several equivalent weights, depending on the shock wave parameter 
selected, i.e., it can be based on peak overpressure or positive impulse. Propellant TNT-equivalence 
can be obtained by cubing the ratio of the X for propellant to the X for TNT at any given overpressure 
level, reference 34. 

/ — — \ X 100 = % TNT Equivalence 
\ ^TNT/ 

Figure 5-13 shows the solid propellant rocket explosive overpressure to be on either side of 
the TNT curve, thus indicating TNT equivalencies above and below 100%. Since the propellant curves 
do not parallel the TNT curve, it can be seen that TNT equivalency is not constant but varies as a 
function of range. Explosive donor type tests conducted by the Naval Weapons Center on explosive 
equivalency of Class 2 (composite type) and Class 7 (composite modified double base type) motors, 
reference 49, showed the explosive behavior to take two forms. For higher yield tests (> 100%) 
the peak overpressure yield tends to decrease with increasing range. In the lower yield tests (< 100%) 
the peak overpressure yield tended to increase with increasing range, the yields tending toward a 
constant value (terminal yield) at long distances. The results of these tests indicated that class 7 
motors (CMDB) tested were capable of producing yields averaging 130% of TNT, and Class 2 motors 
(composite) produced yields as large as 40%. Combined tests of composite and double base motors 
resulted in yields from 105 to 123%. 

Data from Project Sophy, reference 34 obtained from RDX adulterated composite propellant 
tests indicated an average (over range measured) peak side-on overpressure TNT equivalence of 
approximately 197%. Similar data on impulse-TNT equivalence indicated values which varied 
substantially both with range and weight with an average of approximately 1 14%. 

It is brought forth from Project Sophy that terminal yield is defined as the average of the TNT 
equivalences based on both peak overpressure and impulse over the ranges that these tests included. 

The terminal yield of detonating adulterated and unadulterated propellant is 168%. The terminal 
yield for the nondetonating propellant is 156%. 

It should be noted that the pature of these tests biases these data because all samples are nearly 
critical and those that failed to detonate still contributed most of their energy to the fading detonation. 
Much smaller samples certainly would have correspondingly lower TNT equivalents and terminal 
yields. 


Shown in parenthesis on each curve of Figure 5-13 is the reported value of terminal TNT 
equivalency for various tests. Although there exists considerable difference in terminal yield equiva- 
lency data, it can be seen from the Minuteman 3rd stage data that the TNT equivalency can be con- 
siderably higher at close range approaching a lesser value at larger distances. 
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Figure 5-15 shows the reported TNT equivalency (terminal yield) as a function of total 
weight (propellant weight plus donor charge weight) for several composite and double base propellant 
explosive donor tests, references 47 and 37. Combined tests in which a double base propellant motor 
was detonated and used as a donor charge for a composite motor are also shown. 

The upper limit of terminal yield (based on available data) has been indicated on Figure 5-15 
for each propellant type and for combined tests so that a comparison can be made with the Project 
Sophy limits. 

As can be seen, actual test data from composite propellant rocket motor tests does not 
approach the limits established by Sophy. This may be due to the sub-critical size of the motors 
tested where only a "partial*'” detonation or explosion was achieved. Terminal yield TNT equivalency 
for composite modified double base propellant motors of 130-140% shown on Figure 5-15 is in 
agreement with the reported equivalency of 130% reported by Hercules Incorporated, reference 46. 

5.3.2.5 Fireball effects: The most extensive source of fireball data resulting from solid 
propellant motor detonation or explosion has been obtained from Project Sophy, reference 34 
Fireball data were recorded and reduced from a total of 16 atmospheric ground tests made using right 
circular cylinders of propellant varying from 1 1 to 72 inches in diameter and length 4 times the di- 
ameter. The propellant was initiated by a TNT donor charge constituting approximately 1/5 of the 
total test weight. Fireball diameter was taken to be the maximum horizontal dimension of the fireball, 
not the height of the fireball above the ground,, While the exact shapes of these plots differed con- 
siderably from test to test there were certain similarities, in every case, both the height and diameter 
of the fireball increased rapidly to a maximum value, or plateau. The fireball decay pattern differed 
markedly from test to test. 

Figure 5-16 summarizes the main fireball characteristics as a function of total propellant 
weight Total sample explosive weight (propellant plus TNT donor weight) had to be used since it 
was impossible to isolate that portion.of the fireball caused by the TNT donor. Typical solid rocket 
motors are shown superimposed on the curves at their appropriate weight. 

It must be remembered that the Sophy Tests were basically atmospheric propellant critical 
diameter ground tests and that the fireball characteristics of the detonating and non-detonating 
propellant are for a composite formulation with a weight fraction of 69% total oxidizer and 15% 
aluminum. This is, however a representative formulation of many composite propellants in use. The 
Sophy Tests were conducted with samples that were nearly critical or supercritical. Since the litera- 
ture survey did not reveal any published fireball data on subcriticai diameter solid rocket motors or 
on exoatmospheric tests, care should be exercised in using these correlations since very subcriticai 
samples and vacuum testing cannot be expected to produce equivalent data. 

5.3.2.6 Firebrand effects: Collected data on various composite and double base propellants 
show that both types exhibit an ignition type reaction at near identical velocity/mass test conditions, 
reference Figures 5-1 and 5-2. The difference in response to impact varies from burning to explo- 
sion. Explosions or incomplete detonations are often characterized by showers of burning propellant 
fragments or '^firebrands" over a wide area. Although data of this nature is limited due to the un- 
expected nature of rocket motor impact occurrences, some limited data has been compiled, reference 
7, and is presented in Figure 5-17. 
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FIGURE 5-16. - ESTIMATES OF FIREBALL CHARACTERISTICS - SOLID SYSTEMS 
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B.3.2.7 Fragmentation: Existing available fragmentation data, references 7 and 49, resulting 
from solid rocket motor explosions/detonations has been compiled and is presented in Figure 5-18. 
These data were obtained from explosive donor tests and from impact tests performed by military 
agencies. 

In general, the majority of data obtained is from composite propellant rocket. motors. Data 
from composite modified double base propellants is limited. A maximum fragment radius limit 
line has been superimposed on the figure to designate the maximum limit observed from available 
data. A second curve obtained from reference 51 shows the limits established by the U. S. Air Force 
Eastern Test Range based on actual Polaris and Minuteman Missile Explosions/Detonations. The 
fragment range data is plotted as a function of total weight (propellant plus explosive donor) for 
donor tests and as a function of propellant weight for impact tests. 

Fragment studies performed on Minuteman and Polaris Motors, reference 49, indicated that 
only those tests Involving motors with metal casings resulted in significant fragment debris. A typical 
fragment density/ground range relationship is shown in Figure 5-19 for a Polaris detonation test 
Involving a 8,870 lb. CMDB second stage and a 15,200 lb. composite first stage. In this test, the motors 
were placed vertically and a 96 lb. explosive booster was used to initiate the 2nd stage. The estimated 
terminal yield based on total propellant weight was 73 percent. Pieces of burning propellant were 
widely scattered with pieces of unburned propellant found propelled to 1800 ft. and motor parts 
found at distances out to 2500 ft. 

Although this example is shown for a moderate yield explosion, it is probably representative 
of the yields expected for composite propellant rocket motor explosions. Higher yields, representa- 
tive of CMDB propellant motors, may or may not generate fragments over a wider range depending 
on whether the motor case material is metal or fiberglass. 


5.4 Liquid Propellant Systems 

One extremely important fundamental fact concerning liquid propellants is that their 
potential explosive yield is very high, but their actual yield is much lower. This situation occurs 
because the propellant and oxidizer are never intimately mixed in the proper proportions before 
ignition. 

The explosive potential of a given liquid propellant combination in accidental failure is not 
a unique value, but depends on the manner in which propellants are brought together during the 
failure process and on the time of ignition. 

Presently, there are at least four methods for estimating yield of liquid propellant explosions 
which, unfortunately, do not necessarily give the same predictions: One method is based on Project 
Pyro results, reference 35, and two of the others are the "Seven Chart Approach" and the 
"Mathematical Model" of Farber and Deese, reference 52. The fourth approach, which is really 
based on the previous three methods, was developed by Baker, et al., reference 53, and is easy to 
use and readily adaptable to the calculation of explosive yield. 


72 



Max. fragment range (R) ft 



•vJ 

CO 


FIGURE 5-18. - MAXIMUM FRAGMENT RANGE - SOLID PROPELLANT SYSTEMS 
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FIGURE 5-19. - FRAGMENT CHARACTERISTICS FOR POLARIS EXPLOSIVE DONOR TEST 
(REF. 49) 
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The data presented in this Section is based on project Pyro results and has been taken from 
reference 54 which was based on reference 53. 

In this section, three types of fuel and oxidizer combinations and three different modes of 
mixing will be considered. The three types of propellants are: 

1. Hypergolic Propellant — Which is in widest use. A fuel of 50% N2H4 — 50% 

UDMH and an oxidizer of N2O4 in a mass ratio of 1 :2. 

2. Liquid Oxygen — Hydrocarbon — This propellant uses kerosene (RP-1) as a 
fuel and liquid oxygen (LO2) as the oxidizer in stoichiometric mass ratio 
of 1:2.25. 

3. Liquid Oxygen — Liquid Hydrogen — This propellant is an entirely cryogenic 
combination of liquid hydrogen (LH2) fuel and liquid oxygen (LO2) oxidizer 
in stoichiometric mass ratio of 1:5. 

The three modes of mixing (failure modes) discussed are: 

1. Confinement by Missile (CBM) — This type of accident consists of failure 
of an interior bulkhead separating fuel and oxidizer and all propellant 
mixing Is confined within the tankage. 

2. Confinement by Ground Surface (CBGS) — This type of accident Includes 
impacts at various velocities on the ground, with all tankage ruptured, and 
subsequent ignition resulting from propellant mixing on the ground surface. 

3. High Velocity Impact (HVI) — This type of accident involves high velocity 
impact of a missile after launch. 

5.4.1 Explosive Yield . — From the test results reported in references 35, 55 
through 57 and presented by reference 54, a number of observations were made regarding 
blast yields from liquid propellant explosions. 

1. Yield is quite dependent on the particular fuel and oxidizer being mixed. 

2. The yield is very dependent on the mode of mixing of fuel and oxidizer, 

i.e., on the type of accident which is simulated. Maximum yields are experienced 
when Intimate mixing is accomplished before ignition. 

3. On many of the liquid hydrogen/liquid oxygen (LH2/LO2) tests 
(regardless of investigators), spontaneous ignition occurred very early 
in the mixing process, resulting in very low percentage yields. 

4. Yield is very dependent on time of ignition, even ignoring the possibility 
of spontaneous ignition. 

5. Blast yield per unit mass of propellant decreases as total propellant 
mass increases. 

6. Variability in yields for supposedly identical tests was great, compared 
to variability in blast measurements of conventional explosives. 

Table 5-1 provides a sequence to be used in determining the explosive yield of various propel- 
lant/oxidizer combinations and failure modes. To use the table, identify the type of propellant and 
type of accident. Then the proper sequence In'Tart 1" should be followed after making the necessary 
assumptions (e.g., ignition time or impact velocity and type of surface Impacted) to arrive at a value 
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for explosive yield. Explosive yield should then be determined by using the method depicted in 
"Part 2" which involves the use of Figure 5-20 and multiplier factors. The smaller value for explosive 
yield determined in "Part 1" and "Part 2" is the correct value. Thisvalue can then be used to 
determine an effective weight of propellant, and pressure and impulse at scaled distances. 


All of the Pyro experiments, on which the prediction curves in this section are based, were 
conducted on the ground surface, with no cratering. When the curves are used to predict blast yields 
for explosions occurring in flight or far enough above the ground that the shock wave reflection does 
not occur, one must account for the absence of the "perfect" reflecting surface. This is done by 
dividing the blast yields calculated from curves in this section by a factor of two. 

Figure 5-20 is a normalized plot for all propellants and should be used as an upper limit 
for explosive yield. It should be used to obtain the normalized explosive yield (Y) which is then 
multiplied by the multiplier factor for the specific propellant used. The explosive yield obtained 
is the terminal yield (based on TNT equivalence) and can be greater than 100%. Whenever the value 
of percent explosive (terminal) yield, determined by using Table 5-1, exceeds the value of Figure 
5-20, the value from Figure 5-20 is the correct choice. 

5.4.1. 1 Hypergolic (50% N 2 H 4 - 50% UDMFl fuel and N 2 O 4 oxidizer in mass ratio of 1:2): 
Hypergollc meterlals, by definition, ignite spontaneously on contact, so it is not possible to obtain 
appreciable mixing before ignition unless the fuel and oxidizer are thrown violently together. Ignition 
time is therefore not an important determinant of blast yield for hypergolics, but impact velocity and 
degree of confinement after impact are important factors. If a CBM or CBGS failure mode is being 
considered, percent explosive yield can be acquired from Table 5-11. If a HVI failure mode is 
assumed, then percent explosive yield can be determined from Figure 5-21. The percent yield 
determined by any one of these methods must then be compared to the percent yield determined 
from the weight of the propellant. F igure 5-20. The smaller of the two is the correct choice. 

5.4.1. 2 Liquid oxygen -- hydrocarbon (RP-1 fuel LO 2 oxidizer in mass ratio of 1:2.25): 
Because liquid oxygen/hydrocarbon propellants are not hypergollc, considerable mixing can occur 
in various types of accidents, and time of ignition after onset of mixing is an important determinant 
of blast yield. For the case of mixing and an explosion within the missile tankage (CBM), percent 
explosive yield can be determined by assuming an ignition time and then examining Figure 5-22. 

In using Figure 5-22 and subsequent similar "shaded" graphs, the shaded portion represents 
an area In which data from actual propellant blasts was found. The central solid line is an estimate 
of the most likely occurrence and, for most cases, is the recommended choice. Conservative estimates 
of explosive yield can be made by choosing the uppermost boundary of the shaded area. 

The vertical depth of the shaded area at any abscissa indicates the total range of data, and 
therefore the total uncertainty in the estimate. For simulated fallback on the launch pad (CBGS), 
impact velocity as welt as ignition time are important parameters in estimating blast yield. A two-step 
approach has been developed to calculate blast yield. After assuming an impact velocity, maximum 
percent yield (Y^) can be determined from Equation 5-1: 

Y,^ = 5% + (6.82%) V ; , 0 < Vj < = 55.12172 ft/sec (5-1) 

(3.28106) ft/sec 


76 



TABLE 5-1. - SEQUENCE FOR DETERMINATION OF EXPLOSIVE YIELD * 


Type of 

Type of 
accident 
failure mode 

Sequence ** 

propellant 
& oxidizer 

Part 1 

Part 2 (check) 

Hypergollc 

CBM 

Table 5-2 

Figure 5-20 

(50% N 2 H 2 - 
50%UDI\/!H/N204) 

CBGS 

Table 5-2 

Figure 5-20 


HVI 

Figure 5-21 

Figure 5-20 

Liquid Oxygen — 

CBM 

Figure 5-22 

Figure 5-20 

Hydrocarbon 

(LO 2 /RP-I) 

CBGS 

Equation (5-1) 

Figure 5-20 

HVI 

Figure 5-23 
Figure 5-24 

Figure 5-20 

Liquid Oxygen — 

CBM 

Figure 5-25 

Figure 5-20 

Liquid Hydrogen 
(LO 2 /LH 2 ) 

CBGS 

Equation (5-2) 

Figure 5-20 


HVI 

Figure 5-26 
Figure 5-27 



Figure 5-20 


* For explosions occurring far above the ground >10 m/kg^'^^, 

where H is height above the ground), blast yields calculated from curves in 
this section should be divided by two. 


** Correct choice is the smaller of Part 1 and Part 2. 


TABLE 5-11. - ESTIMATE OF TERMINAL YIELD FOR HYPERGOLIC CBM 
ANDCBGS (REFERENCE 54) 


Failure mode 

Terminal yield range 
{%) 

Estimated 
upper limit 

Diaphragm rupture (CBM) 

0.01 - 0.8 

1.5 

Spill (CBGS) 

0.02 - 0.8 

0.5 

Small explosive donor 

0.8 -1.2 

2 

Large explosive donor 

3.4 -3.7 

5 

Command destruct 

0.3 -0.35 

0.5 

310 -ft drop (CBGS) 
(m-. 370478 ft) 

1.5 

3 
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Combined mass of propellant and oxidizer ~ Ibm 

Multiplier factors: (kg = Ibm x .45454) 

(1) Hypergolic — 240% 

(2) LO2/RP-I - 125% 

(3) LO 2 /LH 2 -370% 

FIGURE 5-20. - ESTIMATED TERMINAL YIELD AS A FUNCTION OF COMBINED 
PROPELLANT AND OXIDIZER MASS {REF. 54) 





Terminal yield (Y) ~ % 



FIGURE 5-21. - TERMINAL YIELD VS IMPACT VELOCITY FOR HYPERGOLIC HVI 
(REF. 54) 
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Terminal Yield (Y) % 



FIGURE 5-22. - TERMINAL YIELD VS IGNITION TIME FOR LO2/RP-I CBM (REF. 54) 
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Where is expressed in percent and Vj is in feet per second. Percent explosive yield can then be 
determined from Y^p, and an estimate of ignition time by using Figure 5-23. The determination of 
explosive yield for the HVI failure mode is somewhat simpler because there is little ignition delay 
and therefore only the impact velocity affects yield. Thus, blast yield can be acquired by using 
Figure 5-24 directly. The percent yield determined by any one of these methods must then be 
compared to the percent yield determined from the weight of the propellant. Figure 5-20. The 
smaller of the two values is the correct choice. 

5. 4.1. 3 Liquid oxygen - liquid hydrogen (LH 2 fuel and LO 2 oxidizer in mass ratio of 1:5): 
The determination of explosive yield, for the entirely cryogenic combination of liquid hydrogen 
(LH 2 ) fuel and liquid oxygen (LO 2 ) oxidizer is similar to that of liquid oxygen-hydrocarbon pro- 
pellants. For the CBM case, it is necessary for one to assume an ignition time and then use Figure 
5-25 to find the explosive yield. For the CBGS case, an impact velocity is assumed and maximum 
percent yield (Ypp) can be determined from Equation (5-2): 

Y,.^ = 10% + (4.43%) V| , 0 < Vj < 80.0577 ft/sec (5-2) 

13.28106 ft/sec 

Where Y^p Is expressed in percent and Vj is in feet per second. Percent explosive yield can be 
determined from Y^ and an estimate of ignition time by using Figure 5-26. For high velocity 
impact (HVI), the blast yield is dependent only on the impact velocity and can be acquired from 
Figure 5-27 directly. The percent yield determined by any one of these methods must then be 
compared to the percent yield determined from the weight of the propellant. Figure 5-20. The 
smaller of the two values is the correct choice. 

Examples for determining explosive yield taken from reference 54 are shown in Appendix A. 

5.4.2 Peak Side-On Over Pressure and Impulse (Reference 54). - Throughout the Pyro 
work, reference 30, blast yield is expressed as percent yield, based on an average of pressures and 
impulses measured at the farthest distance from the source when compared to standard reference 
curves for TNT surface bursts (terminal yield). Hopkinson's blast scaling is used when comparing 
blast data for tests with the same propellants and failure conditions, but different mass of propellant. 
Therefore the blast parameters, peak side-on overpressure (P) and scaled impulse (l/W ) 
are plotted as functions of scaled distance (R/W''/^) after being normalized by the fractional 
yield. This procedure is equivalent to determining an effective mass of propellant (W) for the blast 
from the following equation: ^ 

W = W-rX— (5-3 

Where W-y is total mass of propellant and oxidizer, and Y is terminal blast yield in percent. Because 
the data are normalized by comparing to TNT blast data, the effective blast energy (E) can be ob- 
tained by multiplying W by the specific detonation energy of TNT, 

1.4 X 10^ ft Ibf/lbm (4.18 x 10^ J/kg). 
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FIGURE 5-23. - NORMALIZED TERMINAL YIELD VS IGNITION TIME FOR LO 2 /RP-I CBGS 
(REF. 54) 
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Terminal yield (Y) ~ % 




Terminal yield (Y) ~ % 



FIGURE 5-25. - TERMINAL YIELD VS IGNITION TIME FOR LO 2 /LH 2 CBM (REF. 54) 
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FIGURE 5-26. - NORMALIZED TERMINAL YIELD VS IGNITION TIME FOR 
LO 2 /LH 2 CBGS (REF. 54) 
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Table 5-111 contains the different propellant failure mode combinations under consideration 
and the figure numbers of the graphs needed to determine peak side-on overpressure and scaled 
specific impulse as a function of scaled distance for each accident situation. The procedure for finding 
peak side-on overpressure and specific impulse are as follows: 

1. Calculate terminal yield (Y) using methods discussed in Paragraph 5.4.1 

2. Determine the effective mass of propellant and oxidizer (W) from Equation (5-3). 

3. Choose a specific standoff distance (R) from the center of the anticipated 
blast and calculate scaled distance (R/W^^^). 

4. Examine Table 5-111 and acquire the proper figure numbers for finding peak 
side-on overpressure (P) and scaled impulse (l/W^^^) for the particular 
propellant/oxidizer and failure mode under consideration. 

5. Determine peak side-on overpressure (P) from the appropriate Pressure versus 
Scaled Distance curve and the oredetermined scaled distance (R/W^''^). 

6. Determine scaled impulse from the appropriate scaled positive 

impulse versus scaled distance curve and the predetermined scaled distance (R/W^/^). 

7. Calculate specific impulse (I) from scaled positive impulse (l/W^^^). 

That is 

1 = 

Examples for determining peak side-on overpressure and impulse taken from reference 54 
are shown in Appendix A. 

TABLE 5-m. - GUIDE TO SELECTION OF PROPER GRAPHS FOR THE DETERMINATION OF 
PRESSURE AND SPECIFIC IMPULSE (REF. 54) 


Wl/3 


(w'>/3) 


(5-4) 


T ype of 

propellant & oxidizer 

Type of accident 
(failure mode) 

Peak side-on 
overpressure (P) 

Scaled 

impulse 

(l/Wl/3) 

Hypergoiic 
(50% N2H4 

CBM 

Figure 5-28 

Figure 5-30 

50% UDMH/N2O4) 

CBGS 

Figure 5-28 

Figure 5-30 


HVI 

Figure 5-29 

Figure 5-30 

Liquid Oxygen — 
Hydrocarbon 

CBM 

Figure 5-31 

Figure 5-33 

(LO2/RP-1) 

CBGS 

Figure 5-32 

Figure 5-34 


HVI 

Figure 5-32 

Figure 5-34 

Liquid Oxygen — 
Liquid Hydrogen 

CBM 

Figure 5-35 

Figure 5-37 

(LO2/LH2) 

CBGS 

Figure 5-36 

F igure 5-38 


HVI 

Figure 5-36 

Figure 5-38 
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Peak overpressure, (P) ~ psi 



(N/m2 = psi X 6.8947 x lO^) 
(m/kg^/3 = ft/lbm^/^ x ,3966) 


FIGURE 5-28. - PRESSURE VS. SCALED DISTANCE. HYPERGOLIC 

PROPELLANT; CMB AND CBGS FAILURE MODES. (REF. 54) 
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Peak overpressure (P) ~ psi 




Scaled positive impulse (l/W^^^) ~ psi— sec/lbm^^^ 


4 



{N/m^/kg^/^ = psi— sec/1 x 8.9766 x 10^) 

{m/kg1/3 = ft/|bm^/3 ^ .3966) 


FIGURE 5-30. - SCALED POSITIVE IMPULSE VS. SCALED DISTANCE. 

HYPERGOLIC PROPELLANT; CBM, CBGS AND HVI FAILURE 
MODES. {REF. 54) 
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Peak overpressure (P) ~ psi 




6 8 -jqO 


u 


2 4 b a 10' 

Scaled distance, X, (R/W^^^) ~ ft/lbm^^^ 


(N/m^ = psi X 6.8947 X 10^) 
(m/kg^/^ = ft/lbm^^^ x .3966) 

FIGURE 5-32 - PRESSURE VS. SCALED DISTANCE. LO2/RP-I PROPELLANT; 
CBGS AND HVI FAILURE MODES. (REF. 54) 



2 


Scaled distance, X. (R/W^^^) 

(N/m^/kg^/^ = psi— sec/lbm^^^ x 8,9766 x 10^) 
(m/kg^/^ = ft/lbm^'^^ x .3966) 

FIGURE 5-33. - SCALED POSITIVE IMPULSE VS. SCALED DISTANCE. LO2/RP-I 
PROPELLANT; CBM FAILURE MODE. (REF. 54) 



Scaled positive impulse (l/W^^^) ~ psi— sec/lbm^^^ 



(N/m^/kg^/^ = psi— sec/lbm^^^ x 8.9766 x 10^) 
{m/kg''/3 = ft/|bm1/3 x .3966) 

FIGURE 5-34. - SCALED POSITIVE IMPULSE VS SCALED DISTANCE. 

LO 2 /RP-I PROPELLANT; CBGS AND HVI FAILURE MODES. 

(REF. 54) 
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2 


Scaled distance, X, (R/W^/^) 

(N/m^ = psi X 6.8947 x 10^) 
(m/kg^^^ = ft/lbm^^^ x .3966) 

FIGURE 5-35. - PRESSURE VS SCALED DISTANCE. LO 2 /LH 2 PROPELLANT; 
CBM FAILURE MODE {REF. 54) 



[ 6 8 1 
Scaled distance, X, (R/W^/^) ~ft/lbm^^^ 


(N/m^ = psi X 6.8947 x 10^) 
{m/kgl/3 = ft/lbm^/^ ^ .3966) 


FIGURE 5-36. - PRESSURE VS SCALED DISTANCE. LO 2 /LH 2 PROPELLANT; 
CBGS AND HVI FAILURE MODES. (REF. 54) 



Scaled positive impulse (l/W^^^) ~ psi — sec/lbm^^^ 


10-1 



Scaled distance, ft/lbm^*^^ 

(N/m^/kg^/^ = psi — sec/lbm^^^ x 8.9766 x 10^) 
(m/kg^/^ = ft/lbm^/^ x .3966) 

FIGURE 5-37. - SCALED POSITIVE IMPULSE VS SCALED DISTANCE. 

LO 2 /LH 2 PROPELLANT; CBM FAILURE MODE (REF. 54) 
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Scaled positive impulse/-—--) ~ psi-sec/lbrn^/^ 



Scaled distance, X, /— ^ — \ ~ ft/lbm^/^ 

\wl/3/ 

{N/m^/kg^/^ = psi— sec/I bm^^^ x 8.9766 x 10^) 
(m/kg^'^^ = ft/lbm^''^^ x .3966) 

FIGURE 5-38. - SCALED POSITIVE IMPULSE VS SCALED DISTANCE. LO 2 /LH 2 
PROPELLANT; CBGS AND HVI FAILURE MODES (REF. 54) 
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5.4.3 Fireball Effects 


5.4.3. 1 Characteristics: The fireball generated by the explosion of propellant mixtures can 
constitute a hazard primarily through heat transfer to an object or structure immersed in it. 

Gayle and Bransford, reference 58, have derived empirical expressions for the dimensions 
and duration of a fireball associated with an explosion of liquid bi-propellants. Equations 5—5 and 
5—6 relate the fireball dimension in terms of equivalent diameter (D), In feet, and the fireball dura- 
tion, r, in seconds, to the total propellant (fuel plus oxidizer) weight (W) in pounds, for the propellant 
combinations L02/RP*1, LO2/LH2, LO2/RP-I and LH2, and N2D4/N2H4 - UDMH (50:50) 

D = 9.56 W (5-5) 

r= 0.196 W 0-329 (5-6) 

The estimated error expected in D is 30% and in r is 84% since some of the fireball observa- 
tions used to derive the empirical relations were markedly asymmetrical. The magnitude of the 
departure from the diameter given by equation 5-5, is indicated by data from an actual Titan test 
that involved 100,000 pounds of LO2/RP-I ; wherein the maximum fireball horizontal dimension 
was estimated to be from 800 to 1000 feet, while equation 5—5 yields an equivalent diameter of 
approximately 400 feet. 

Equations 5—5 and 5—6 are shown plotted on Figure 5-39 along with equations 5-7. In a 
related Saturn Program investigation of fireball characteristics, J. B. Gayle, reference 59, derived 
similar diameter/duration/propellant weight relationships which are shown in Figure 5-40. These 
relationships are very similar to Gayle and Bransford's empirical relations and differ by only 3% and 
10% for maximum diameter and duration time, respectively, in the range of Space Shuttle application 
(100 to 10,000 lb. total propellant weight). In a discussion of Gayle's expressions by R. W. High, 
reference 60, the author attributes the scatter of test data (shown on Figures 5-40A and B) to the 
difficulty of estimating the end point of incandescent gases in the presence of smoke and water vapor 
and from variations in the test failure mode. In his conclusion, however. High considers the equation 
to furnish a reasonable estimate of fireball duration. 

5.4.3.2 Heat flux density: Heat flux data obtained from the literature survey is based 
primarily on information published on project Pyro, reference 35. A discussion of this data taken 
from reference 35 follows. 

Curves from which the heat flux density versus time within the fireball can be obtained 
for a given propellant weight are given on Figures 5-41 and 5-42 for the LO^/RP-1 and LO2/I-H2 
propellant combinations, respectively. The time in these figures is given in seconds by, 

To=CW'*/2 (5-7) 

The total propellant weight (W) is in pounds, and the value of C is 0. 1 13 for L02/RP‘1 , 
Figure 5-41 and is 0.077 has LO2/LH2, Figure 5-42. Two curves are presented in each figure. 

One is the "bounding curve", which is an estimate of the upper bound of the heat flux density and 
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Equivalent diameter (D) ~ft 



Time duration (t or Tq) 



10 " 

I 


D = 9.82W 


O RP-1/LOX 
A LH 2 /LOX 
• RP-I/LH 2 /LOX 
▲ UDMH/N2H4/N2O4 


Total propellant weight (W) ~ pounds 

A. Fireball diameters for various weights and types of propellants 


Saturn V 


Duration = 0,232W'^‘^^ 




O RP-1/L0X 
A LH 2 /LOX 
• RP-I/LH2/LOX 
A UDMH/NoHv,/NoO 


Total propellant weight (W) ~ pounds (kg - lbs x ,4540) 

B. Fireball duration for various weights and types of propellants .3048) 

FIGURE 5-40. - SATURN FIREBALL CHARACTERISTICS {REF. 59) 
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Time (r) ~ sec 


Note: C = 0.1 13 


FIGURE 5-41. — BOUNDING AND RECOMMENDED HEAT FLUX DENSITY CURVES 
(REF. 35) 




Heat flux density 



Time (r) ~ sec 


Note: C = 0.077 


FIGURE 5-42. - BOUNDING AND RECOMMENDED HEAT FLUX DENSITY CURVES 
{REF. 35) 
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is primarily based on the analysis of heat flux density data that were obtained from eleven 25,000-lb 
propellant tests, five of LO 2 /RP-I, and six of LO 2 /LH 2 .* The remaining curve, designated the 
"recommended curve", is superimposed on the bounding curve out to a time, Tq, given by Equation 
5-7, — where it abruptly decreases to zero. The recommended curve is based primarily on analysis 
of the data from the eleven 25,000-lb tests mentioned above, and implicitely contain the constraint 
that the probability of exceeding the cumulative heat flux density associated with the recommended 
curve (the time integration of the heat flux density from time equal zero to Tq) is 1%. The variation 
of the heating pulse with propellant weight, that is, the scaling implicitely contained In Figure 5-41 
and 5-42 and Equation 5-7, assumes the following: 

(a) The duration of the heating pulse will increase with the cube root of the 
propellant weight, as Implied by the empirical relation Equation 5—6. 

(b) The heat flux density at a scaled time, using the above cube root time 
scaling, will be invariant with variation in propellant weight. 

The second statement is based on the invariance of fireball temperatures (measured) from scale to 
scale. 


No consideration has been given in the 'bounding' or 'recommended' curves for the emission 
of radiant energy from the surface of an immersed object, but this emission can substantially reduce 
the transfer rates from those given in the curves as the surface temperature of the object becomes a 
significant fraction of the fireball temperature, approximately 368 I^F (2027^0. A reduction occurs 
similarly for the convective component of transfer. Any other corresponding modifications of heat 
transfer from the curves are not considered here. 

Several other qualifications of the 'bounding' and 'recommended' curves should be noted. 

(a) The heat flux density measurements upon which the curves are primarily based 
were obtained from instruments that were fixed in space; thus, a modified heat 
flux density may be appropriate for objects which, for example, become prematurely 
ejected from the fireball (due, for instance, to blast wave forces). For many cir- 
cumstances, the modification would be a reduction of the total heat transfer, first, 
due to the tendency to reduce the time that an object is immersed, and second, due 
to a reduction in the convective heat transfer component, since the motion imparted 
to the object by the blast wave forces would tend to reduce the relative velocity 
between the object and the surrounding gas. Rotary motion imparted to the object, 
however, would generally result in an increased transfer rate at given locations on the 
object. 


*Data from which the heat flux density may be evaluated for the N2O4/50% N2H4-50% UDMH 
propellant combination are extremely limited. Examination of these data suggests that the heat 
flux density is somewhat less In magnitude than the bounding curves given for LO 2 /RP-I and 
LO 2 /LH 2 in Figures 5-41 and 5-42, but that the heating durations are perhaps somewhat larger. 
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It can be seen from Equation 5-7 that the heating durations (Tq) of Figure 5-41 and 5-42 
(of either the bounding or recommended curves) increase with the cube root of propellant weight. 
Therefore, for small propellant quantities, say 1000-lb or less, the fireball duration is insufficient for 
appreciable motion (rise) of the fireball, and the fireball duration is then essentially synonymous with 
the heating duration of an object that is fixed in space. For larger propellant quantities, 25,000-lb and 
more, significant motion does occur and the heating duration of a fixed object is therefore less than 
the fireball duration. Thus, the ratio of the heating duration of a fixed object to the total fireball 
duration is some function of the propellant weight. The curves of Figure 5-41 and 5-42 are based 
on measurements fixed in space at the 25,000-lb level, and extrapolation to other propellant weight 
levels through Equation 5—7 inherently assumes an invariance of this ratio of durations. For applica- 
tion to weights In excess of 25,000-lb, it is nevertheless recommended that Equation 5-7 be used in 
conjunction with the curves of Figure 5-41 and 5-42, although it is expected that the curves would 
be somewhat conservative. For extrapolation to significantly lesser weights, Tq should be larger than 
given by Equation 5—7; more specifically, at the 1000-lb (or less) level, Tq , as given by Equation 5—7, 
should be increased by a multiplying factor of approximately 1.2 and 1.6 for LO 2 /RP-I and LO 2 / 
LH 2 , respectively. 

It is possible that the heat transfer hazard can be intensified by the occurrence of chemical 
activity between the fireball constituents — notably the oxidents — and the surface of an object 
immersed in the fireball. Predictions of the rates (or existence) of the associated chemical reactions 
are not included in this report, in part due to the heavy dependence of such reactions on the parti- 
cular application that is, on the molecular constituents of the object and surface temperature attained. 
The latter, in turn, depends on the configuration and thermal properties of the object. (The reaction 
also depends critically, of course, on the concentrations of various atomic and molecular species — and 
their excited and ionized states — present in the fireball.) Chemical activity is mentioned and should 
be considered in any application — particularly when comparatively large propellant quantities are 
Involved - because the reactions can provide an energy contribution (not included in Figure 5-41 and 
5-42) to the object. 

The heat flux density measurements upon which the curves of Figures 5-41 and 5-42 are 
based were obtained at locations no closer to the '^center of explosion" than about one-fifth of the 
radius of the fireball, and it would be expected that the heat transfer rates, at least during the initial 
"small" fraction of the fireball duration, could be somewhat more severe at or "very near" the center 
of explosion. Passive sensors capable of providing crude indications of comparatively severe heat 
transfer were deployed in the central region (within a few feet of the planned ignition point) through- 
out most of the eleven 25,000-lb tests mentioned above, and a single positive indication was obtained. 
Specifically, from 0.1 to 0.2 in. was ablated from the surface of a solid aluminum structure in such a 
way as to suggest comparatively large heat flux densities over limited times, for instance, of the order 
of 1000 watt/cm^ for 2 sec. (A thorough analytic evaluation of the possible ranges of heat transfer 
parameters resulting in the above ablation has not been performed; for details of the aluminum struc- 
ture and its ablation, see reference 35, Appendix C of Volume 1 .) It is not clear If chemical activity, 
as mentioned in the previous paragraph, was an energy contributor. 
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5.4.4 FragmGntation. — SpacG vGhiclG fragmGnts gGriGratGd during accidGntal Gxplosions can 
comG from sGVGral sourcGs. Thay can be pieces of the exploding vGssals/tanks, or pieces of wreckage 
from an impact which also results in an explosion, or nearby objects accelerated by the blast waves 
from the explosion. 

The methods for estimating initial fragment velocities for various types of accident and 
geometry, fragment ranges, fragment mass distributions, depths of penetration, striking velocities 
have been treated at depth by various authors and will not be presented here. The reader is referred 
to reference 54 and 61 for detailed discussion. 


An indication of the fragment propagation range taken from reference 61 is shown in Figure 
5-43. The maximum fragment range units as a function of TNT equivalence are given based on 
available fragment data points from launch vehicle incidents with the upper boundary considered 
applicable to high order explosive reactions of propellants and the lower boundary applicable to 
widely distributed and tow order reactions (deflagration/low order explosion). 

Figures 5-44 and 5-45 show the total weight and number of fragments for the specific 
tests shown in Figure 5-45. Table 5-tV summarizes the fragment data used in the curves. 


5.5 Gas Pressure Vessel Hazards 

When a pressurized gas-filled vessel bursts it generates a shock wave which is. in many ways 
similar to the one generated from a TNT explosion. The overpressure behind this shock wave may 
be quite large and capable of causing damage. 

The TNT equivalency of compressed gas obtained from reference 62 is shown in Figure 5-46. 
The equivalency is shown for gas (7 = 1-4) expansion to one atmosphere pressure. The figure is based 
on the gas behaving like a perfect gas over the range of pressures and temperatures involved. It is also 
assumed that the gas expands adiabatically (no heat transfer) and isentropically (maximum energy 
release). The results should be very good for the one atmosphere case, but some errors can be expected 
at the highest pressure shown for this case, and for the full range for the vacuum case, because of 
liquefaction and solidification of the gas at the extremely low temperatures to which it expands. 

To obtain peak side-on overpressure and positive phase impulse for a pressure vessel burst, 
Figure 5-46 can be used to obtain TNT equivalency and Figure 5-47 can then be entered by 

1 -1 -j- ^ A /Ground Distance \ 

converting the distances involved to scaled distances A “ r 

\ WeightTNjI/'^ / 

Peak overpressure can alternately be obtained by using Figure 5-12 directly. 

Fragmentation parameters are covered at great length by several publications and the reader 
is referred to references 54 and 61 for a detailed discussion. 
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Maximum observed fragment distance ~ ft 



TNT equivalence (Y) lb 

FIGURE 5-43. - ESTIMATED TNT EQUIVALENCE VS. MAXIMUM FRAGMENT DISTANCE 
FOR ACTUAL SPACE VEHICLE EXPLOSIONS (REF. 61) 


(kg = lbs X .454} 
(m = ft X .3048) 


o 



RANGE INDICATED 



Estimated total 

Symbol Vehicle weight (lb) 

O Atlas-Centaur 9085 
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Range of fragments ~ ft ^ .3048) 

FIGURE 5-45. — PERCENTAGE OF TOTAL NUMBER OF VEHICLE FRAGMENTS WITHIN RANGE INDICATED (REF. 61) 
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TABLE 5-lV. - FRAGMENT DATA FROM SELECTED SPACE VEHICLE EXPLOSIONS (REF. 61) 


Vehicle 

site/date 

Propellant/ 

lb 

Yield 

TNT 

(%)/lb 

Incident 

Number of 
fragments/ 
weight, lb 

Source 

Major 
fragment 
radius, ft 

Average fragment 
density/ 10,000 ft^ 
outside fragment 
radius 

S-IV-ASTV 

Douglas-Sacramento 

1-24-64 

LO 2 /LH 2 

100,000 

(1%) 

1,000 

Explosion 

Overpressurization of 
LOX tank to 100 psia 

262 Total 

44 Wt'd 
1,882 

Investigation of S— IV 
Vehicle explosion by 
J. B. Gayle 

400 

.31 

Atlas Centaur 

KSC 

3-2-65 

LO 2 /LH 2 

30,000 

LO 2 /RP-I 

172,000 

Total 

(0.75%) 

1,930 

Launch 

AtT 1.1 sec. the 
booster engine cut- 
off at T 1 .63 vertical 
vel. = 0. 

Vehicle fell back 
bursting the booster 
tanks 

40 

9,085 

Investigation of 
the Atlas Centaur 
Vehicle explosion 
by S. S. Perlman 

400 

.29 

284,000 

S-IV-EAFB 
Edwards 
7-14-65 
Test Vehicle 
Run 062 

LO 2 /LH 2 

91,000 

(3.5%) 

3,200 

Induced failure 
18 in. ram on inter- 
tank bulkhead 


Project PYRO 
Quarterly Progress 
Report 9/65 

500 

.5 

S-IVB-503 

Douglas-Sacramento 

1-20-67 

LO 2 /LH 2 

231,000 

(1%) 

2,300 

Explosion 

On repressurization. 
Wrong type welding 
rod, titanium spheres 

166 

1,426 

Report of 
Investigation 
S-IVB-503 
Incident 1-20-67 by 
Kurt B. Debus, KSC 

600 

.81 

PYRO-275 
(Test Tanks) 
APR PL Edwards 
3-22-67 

LO 2 /RP-I 

25,000 

j 

(4%) 

1,000 

Tank rupture 
Self-ignition after 
500 milliseconds 
of mixing 

60 

1,628 

Project PYRO 
Reports 
3-67, 6-67 

500 

.30 


(kg = lb X .454} 
(m = ft X .3048) 









































Energy equiv. — kg of TNT per of tank volume 
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FIGURE 5-46. - COMPRESSED GAS TNT EQUIVALENT {REF. 62) 
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The largest anticipated usage of compressed gas for Space Shuttle payloads is expected to be 
associated with upper stage vehicles requiring propellant system pressurization gases, and with Space 
Station modules which require atmospheric pressurization and re-pressurization gases. Scout, for 
example, requires a nitrogen pressurization source for the reaction control system. A “B" stage 
nitrogen tank pressurized to 3000 psi (2.1x10^ N/m^), with an internal volume capacity of. 223 ft^ 
(.0063 m^), has a TNT equivalency, from Figure 5-46, of .1736 lb. (.0788 kg). 

From Figure 5-47, the peak side-on overpressure and positive phase impulse estimated at a 
distance of 5 feet would be: 

5 ft 

X — •! /o — 8.963 

(.1736 lb) 


Therefore P = 125 psi at X = 8.963 and 


L 

D 


.95 psi - msec 
ft 


2.1489 X 10^ 


N/m^— ms 


m 


Therefore I = (.95) (5) = 4.75 psi — msec (3.2749 N/m^— ms) 


5.6 Summary 

A literature review yielded considerable Information concerning liquid propulsion system 
hazards but somewhat limited information concerning solid rocket motor hazards. The most re- 
vealing information was obtained from Projects Pyro (liquid propellants) and Sophy (solid pro- 
pellants). However, the results presented were based on a number of other sources. 

In an effort to determine the thresholds of a solid propellant motor ignition, explosion, or 
detonation resulting from an impact, data were compiled on various impact tests, accidents, missile 
fallback data, shotgun tests and flying plate tests. A subjective extrapolation between the data 
points was performed so that the interfaces between the inert-explosive/burn and explosive/burn- 
detonate regions could be delineated. It was found that the composite and composite-modified 
double base (CMDB) propellants had about the same interface between the inert-explosive/burn 
regions but the higher energy release interface was lower for the CMDB system. 

Critical diameter tests performed by Project Sophy have identified a minimum critical dia- 
meter of 64.2 inches for solid cylindrical PBAN composites having a weight composition of 69% AP 
and 15% AL. The pseudocritical geometry has been shown to be approximately 92% of the critical 
diameter. These relationships indicate that composite solid rocket motors which are candidates for 
Space Shuttle use and have similar compositions are relatively safe from donor charge detonation 
when they are of subcritical size. 
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Double base propellants investigated and composite propellants with high energy additives 
have been found to have critical diameters which decrease with increasing degree of high energy 
enrichment. The critical diameter is in the order of 2.0 inches or less which Is small compared to the 
64.2 Inches for PBAN propellants. 

The threshold overpressure for detonation of PBAN composites has been established by Pro- 
ject iSophy to be 25 to 30 kbars for propellants near their critical diameters (64.2 in.) NOL card-gap 
tests of composites have shown that they will not detonate in the subcritical diameter size (less than 
2.0 in.) with incident pressures in the order of 100 kbars. Data on double base propellants, based on 
NOL card-gap tests (test samples less than 2.0 in. in diameter), indicates detonation thresholds of the 
order of 30 to 44 kbars for the propellants investigated. 

The effects of solid propellant motor explosion/detonations have been characterized in terms 
of resulting near side-on overpressure, impulse, TNT equivalency, fireball/firebrand effects, and frag- 
mentation. Data presented provides methods for estimating the required values of these parameters. 

TNT equivalencies have been obtained from various test programs and have been defined 
in general terms as follows: 

Composite propellants near their critical diameters of the composition used in Project Sophy 
are capable of explosive yields of 156% to 168% based on combined overpressure and impulse data. 
These propellants can show higher yields (197%) based on peak side-on overpressure only. 

Actual tests of smaller rocket motors indicate that these yields are rarely achieved and that 
composites achieve yields in the order of 85% TNT equivalency while double base propellants can 
achieve yields up to 140% TNT equivalency. Combined tests of double base and composite pro- 
pellants in which the former was used as the donor achieved yields in the order of 125% TNT 
equivalency. 

Liquid propellant system hazards have been evaluated on the basis of three types of fuel and 
oxidizer combinations and three different modes of mixing. Hypergolic propellants (50% N2H4 — 
50% UDMH and N2O4), RP-I-LO2, and LH2-LO2 were evaluated in the confinement by missile, 
confinement by ground surface, and high velocity impact failure modes. Tables and figures are 
provided so that calculations of explosive yield, peak side-on overpressure, and impulse can be 
performed. Determination of fireball effects, heat flux density and fragmentation based on test 
results obtained from Project Pyro and other tests is presented and will provide an insight of the 
magnitudes of the parameters involved. 

Gas pressurization bottles also can provide an explosive yield, peak side-on overpressure if 
ruptured. Figures are also presented so that these parameters can be determined for bottles 
pressurized up to 10,000 psi (6.894 x 10^ N/m^). 
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6.0 PRELIMINARY HAZARD ANALYSIS OF ROCKET SYSTEMS FOR SHUTTLE PAYLOAD 


6.1 Solid Propellants 


Introduction. - A Preliminary Hazard Analysis (PH A) of the Scout propulsion system 
has been performed in order to determine the possible hazards of utilizing the Scout upper stage solid 
Consideration Tree, Figure 6-1. The analysis was based on the upper stage solid rockets of the Scout 
vehicle; however, it is applicable to solid rocket propulsion systems in general, except the reaction 
control system which is unique to the Scout system. 

6.1.2 System Safety Program. - A System Safety Program is required in order to assure 
compliance with the requirements outlined in the NASA Headquarters Safety Policy and Require- 
ments Document, reference 20. 

A hazard analysis as described in NASA System Safety Manual, reference 21, has a logic 
sequence of events as follows: (a) General Safety Studies, (b) Preliminary Hazard Analysis, (c) Fault 
Hazard Analysis, (d) Logic Diagram Analysis, and (e) Procedures Analysis. In Figure 6-2, these 
analyses are shown relative to the program activity phases. DOD components follow a System 
Safety Program as outlined in MIL-STD-882, reference 18. These are as follows: (a) Preliminary 
Hazard Analysis, (b) Subsystem Hazard Analysis, (c) System Hazard Analysis, and (d) Operating 
Hazard Analysis. SAMSO has documented these requirements in reference 63 and outlines the 
program as consisting of a Preliminary Hazard Analysis, Operating Hazard Analysis, Fault Hazard 
Analysis, Fault Tree Analysis, Software Hazardous Effects Analysis, and Cable Failure Matrix. In 
Figure 6-3 the SAMSO approach to safety analyses events and program milestone coordination are 
shown. A Space Transportation System user must have a System Safety Program and plan for per- 
forming these analyses in an orderly and timely manner so that hazards will be identified with sub- 
sequent elimination, reduction, control, or placarding of each critical and catastrophic hazard. The 
approach used by SAMSO, as outlined in reference 63, is the System Safety Program developed for 
the Minuteman Program by the Boeing Aerospace Company. The purpose of each of the required 
analyses is discussed in the following paragraphs. 

6. 1 .2. 1 Preliminary Hazard Analysis: This analysis is used by the contractor to identify and 
document the system/subsystem hazards recognized in the early conceptual and design phases so that 
by process and /or procedural constraints the hazards can be eliminated or minimized to an acceptable 
level. 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Shuttle or Scout 
non-propulsion 
system fire 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

High motor tempera- 
atures 

Utilize motors of high 
auto-ignition tempera- 
tures 

Motor auto-ignition 
temperatures are as 
follows; 

3rd stage — 

392° F (200°C) 

12 min. 

4th stage — 

300° F {149°0 
24 hrs. 
no ignition 
spin motor — 
350° F (177°C) 

8 hrs. 

Thermally insulate the 
motors to protect 
from max. shuttle bay 
temperature of 150°F 
(65. 5°C) during launch 

OPEN 

Utilize motors which 
have propellant that is 
resistant to detonation 
in a fire 

No known case of 
solid motor detonation 
during cook-off. 
Cook-off can cause an 
explosion-deflagration 

Shuttle 
damage or 
loss 

1.2 

Scout propulsion system 
fire 

Ignition of Scout 
propulsion system 
materials 

Select system materials 
that are resistant to 
combustion 

Because of H 2 O 2 
systems 

Scout is designed with 
low combustion 
materials 













TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 



Ultimate Safety 
effect 

number 


Intermediate effects 


Shuttle or scout 
non-propulsion 
system fire 
(continued) 



Explosive rupture of 
motor case 


Scout propulsion 
system fire 


Severe 
shuttle 
damage or 
loss 


Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system rupture or 
leak 


Premature motor 
ignition or detonation 


High temperature 
causing propellant 
grain cracks or bond 
separation resulting in 
case rupture when 
motor is ignited during 
normal launch 


Thermal over-pressuri- 
zation of RCS system 


High motor tempera- 
tures 


Preventive action 


Abort motor ignition 
if a fire occurs in the 
vicinity of the motor 
and propellant flaw is 
suspected 

Delay first stage ignition 
of the payload until 
sufficient separation 
exists so that shuttle 
cannot be damaged by 
ignition of flawed 
motor 


Provide pressure relief to 
exterior of the shuttle 


Provide warning regarding 
personnel hazards to 
operating personnel 


Utilize motors of high auto- 
ignition temperatures 


Thermally insulate the 
motors to protect from 
max. shuttle bay tempera- 
ture of 150°F (65.5°C) 


Scout status of 
implementation 


Must be defined in 
mission procedures: 

OPEN 


Must be defined in 
mission procedures: 

OPEN 



Standard operating 
procedures contain 
warning, caution, 
and notes regarding 
RCS system hazards 


Motor auto-ignition 
temperatures are as 
follows: 

3rd stage — 

392° F {200°C} 

12 min. 

4th stage — 

300° F (149°C) 
24 hrs. 
no ignition 
spin motor — 
350° F (177°C) 

8 hrs. 


OPEN 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Scout Propulsion 
system fire 
(continued) 





Utilize motors which have 
propellant that is resistant 
to detonation in a fire 

No known case of 
solid motor detona- 
tion during cook-off. 
Cook-off can cause 
explosion-deflagra- 
tion 


Severe 
shuttle 
damage or 
loss 

1.2 

Explosive rupture of 
motor case 

High temperature 
causing propellant 
grain cracks or bond 
separation resulting 
in case rupture when 
motor is ignited 
during normal launch 

Abort motor ignition if a 
fire occurs in the vicinity of 
the motor such that pro- 
pellant flaw is suspected 

Must be defined in 
mission procedures: 

OPEN 





Delay first stage ignition of 
the payload until 
sufficient separation exists 
so that shuttle cannot be 
damaged by ignition of 
flawed motor 

Must be defined in 
mission procedures: 

OPEN 

Environmental 

heating 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor 
ignition or detonation 

High motor temperatures 

Utilize motors of high 

auto-ignition 

temperatures 

Motor auto- ignition 
temperatures are 
as follows: 

3rd stage — 

392° F (200°C) 

12 min. 

4th stage — 

300°F (149°C) 

24 hrs. 
no ignition 
spin motor — 
350° F (177°C) 

8 hrs. 






Thermally insulate the 
motors to protect from 
max. shuttle bay tem- 
perature of 150°F (65.5°C) 
during launch 

OPEN 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Environmental 

heating 

{continued) 





Utilize motors which 
have propellant that is 
resistant to detonation 
in a fire 

No known case of 
solid motor detona- 
tion during cook-off. 
Cook-off can cause 
an explosion-deflag- 
ration 






Conduct qualification tests 
to demonstrate insensitivity 
to expected environmental 
temperature extremes 

OPEN 


Severe 
shuttle 
damage or 
loss 

1.2 

Explosive rupture of motor 
case 

High temperature 
causing propellant 
grain cracks or bond 
separation resulting 
in case rupture when 
motor is ignited 
during normal launch 

Abort motor ignition if a 
fire occurs in the vicinity of 
the motor and propellant 
flaw is suspected 

Must be defined in 
mission procedures; 

OPEN 





Delay first stage ignition of 
the payload until sufficient 
separation exists so that 
shuttle cannot be damaged 
by ignition of most flawed 
motor 

Must be defined in 
mission procedures: 

OPEN 






Conduct qualification tests 
to demonstrate insensitivity 
to expected temperature 
extremes 

OPEN 


Shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resultinq from RCS 
system rupture or leak 

Thermal overpressur- 
ization of RCS system 

Provide pressure relief to 
exterior of the shuttle 

OPEN 




Provide personnel warning 
in procedures regarding 
RCS system hazards 

Standard operating 
procedures contain 
warning, caution, & 
notes regarding RCS 
system hazards 






Provide adequate safety 
margins in nitrogen & 
hydrogen peroxide 
reservoir design 

Reservoir proof 
pressure is 1 .5 times 
operating pressure 
and burst pressure is 
2.5 times operating 
pressure 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Environmental 

heating 

(continued) 





Conduct qualification 
tests to demonstrate 
insensitivity to expected 
temperature extremes 

Some tests performed 
OPEN 






Thermally insulate sections 
to protect from max. 
shuttle bay temperature 
of 150°F (65.5°C) during 
launch 

OPEN 

Meteoroid impact 
(this hazard exists 
only during orbit 
phase) 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

Energy impacted by 
meteoroid causing 
propellant ignition 

Minimize exposed vehicle 
skin 

Analyses indicate 
that present concept 
affords sufficient 
protection 


Shuttle 
damage 
or loss 

1.2 

Explosive rupture 
of motor case 

Energy impacted by 
meteoroid causes 
propellant grain 
crack resulting in 
case rupture when 
motor is ignited 

Minimize exposed vehicle 
skin 

Analyses indicate 
that present concept 
affords sufficient 
protection 





Abort normal motor 
ignition if propellant flaw 
is suspected 

Appropriate warning 
should be included 
in deployment 
procedures 

OPEN 






Delay first stage ignition of 
the payload until sufficient 
separation exists so that 
shuttle cannot be damaged 
by ignition of flawed motor 

Must be defined 
in mission procedures: 

OPEN 


Severe 
shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, fire, 
chemical attack of mater- 
ials, or toxicity resulting 
from RCS system rupture 
or leak 

Meteoroid impact 
with RCS system 
causing leak or 
rupture 

Provide protection of RCS 
system from meteoroid 
impact 

RCS system is 
contained entirely 
within airframe 


































TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 


Intermediate effects 

Preventive action 

Scout status of 
implementation 

Fragment impact 
from shuttle or 
non-propulsion 
system rupture or 
explosion 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

Fragment impact 
energy insufficient to 
cause severe shuttle 
damage may cause 
motor ignition or 
detonation 

Conduct qualification tests 
to demonstrate motor 
insensitivity to fragment 
impact 

OPEN 


Severe 
shuttle 
damage or 
loss 

1.2 

Explosive rupture of motor 
case 

Fragment impact 
energy insufficient to 
cause severe shuttle 
damage directly 
may cause propellant 
grain flaw resulting 
in explosive rupture 
of motor case when 
motor is ignited 

Abort normal motor ignition 
if propellant flaw is suspecte 
suspected 

Mission procedures: 
OPEN 




Delay first stage ignition of 
the payload until sufficient 
separation exists so that 
shuttle cannot be damaged 
by ignition of flawed motor 

Must be defined in 
mission procedures 

OPEN 


Shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system rupture or leak 

Fragment impact 
energy insufficient 
to cause severe 
shuttle damage 
directly may cause 
rupture or leak of 
RCS system 

Provide protection of RCS 
system from fragmentation 

RCS system is 
located entirely 
within missile 
airframe 




Provide personnel warning 
in procedures regarding 
RCS system hazards 

Standard operating 
procedures contain 
warning, caution, & 
notes regarding RCS 
system hazards 

Environmental 

vibration 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

Vibration energy 
absorbed by motors 
may cause ignition 
or detonation. 
Considered a very 
low probability. No 
known occurrence 

Conduct qualification tests 
to demonstrate motor 
insensitivity to vibration 

Some test performed 
OPEN 




Design payload pallet to 
attenuate vibration 

OPEN 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Environmental 

vibration 

{continued) 

Severe 
shuttle 
damage or 
loss 

1.3 

Explosive rupture 
of motor case 

Vibration energy 
absorbed by motors 
causing cracks in 
propellant grain 

Abort normal motor 
ignition if propellant 
flaw is suspected 

Must be defined in 
mission procedures: 

OPEN 





resulting in case 
rupture upon ignition 

Design payload pallet to 
attenuate vibration 

OPEN 






Delay first stage ignition 
of the payload until 
sufficient separation exists 
so that shuttle cannot be 
damaged by ignition of 
flawed motor 

Must be defined in 
mission procedures: 

OPEN 


Shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system rupture or leak 

Structural failure of 
RCS system causing 
leak or rupture 

Design RCS system to 
withstand expected 
environment 

OPEN 





Conduct qualification 
tests to demonstrate 
ability to withstand 
vibration 

RCS system 
components are 
tested to the follow- 
ing minimum level: 

• time per axis: 
(seconds) 80 

• frequency (Hz) 

20 to 2000 
grms 10.55 






Design payload pallet to 
attenuate vibration 

OPEN 






Provide personnel warning 
in procedures regarding RCS 
system hazards 

Standard operating 
procedures contain 
warning, cautions & 
notes regarding RCS 
system hazards 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Uitimate 

effect 


Severe 
shuttle 
damage or 
loss 


Severe 
shuttle 
damage or 
loss 


Intermediate effects 


number 



Premature motor 
ignition or detonation 



Explosive rupture 
of motor case 


Shuttle 
damage or 
loss 


Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system rupture or leak 


Shock energy 
absorbed by motors 
may cause ignition 
or detonation 


Shock energy 
absorbed by motors 
causing cracks in 
propellant grain 
resulting in case 
rupture upon ignition 


Structural failure of 
RCS system causing 
leak or rupture 


Preventive action 


Conduct qualification tests 
to demonstrate motor 
insensitivity to shock 


Design pallet to attenuate 
shock 


Abort normal motor ignition 
if propellant flaw is 
suspected because of 
excess shock loads 


Delay first stage ignition 
of the payload until 
sufficient separation exists 
so that shuttle cannot be 
damaged by ignition of 
flawed motor 


Design RCS system to with- 
stand expected environment 


Conduct qualification tests 
to demonstrate ability to 
withstand shock 


Scout status of 
implementation 



Must be defined in 
mission procedures 

OPEN 


Must be defined in 
mission procedures 

OPEN 



RCS system compo- 
nents are tested to 
the minimum level 
of at least 30g in 
any direction 

OPEN 


Design pallet to attenuate 
shock 


Provide warning regarding 
personnel hazards to 
operating personnel 



Standard operating 
procedures contain 
warning, cautions, & 
notes regarding RCS 
system hazards 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Continued 


Hazard 

Ultimate 

effect 

Safety 

tree 

number 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Shock from 
shuttle or Scout 
non-propulsion 
system rupture or 
explosion 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

Shock energy insuf- I 

ficient to cause 
severe shuttle damage 
may cause motor 
ignition or detonation 

Conduct qualification tests 
to demonstrate motor 
insensitivity to shock 

OPEN 


Severe 
shuttle 
damage or 

1.3 

Explosive 

rupture of motor case 

Energy insufficient to 
cause severe buttle 
damage directly may 

Abort normal motor 
ignition if propellant flaw 
is suspected 

Must be defined in 
mission procedures 
OPEN 


loss 



cause propellant grain 
flaw resulting in 
explosive rupture of 
motor case when 
motor is ignited 

Delay first stage ignition 
of the payload until 
sufficient separation exists 
so that shuttle cannot be 
damaged by ignition of 
flawed motor 

Must be defined in 
mission procedures 

OPEN 

Electrical 

fault 

Severe 
shuttle 
damage or 
loss 

1.1 

Premature motor ignition 
or detonation 

Spurious electrical 
signal in ignition 
circuit 

Design ignition system to 
minimize likelihood of 
spurious electrical signal 

Shielded twisted 
wiring 

OPEN 






Utilize electro-mechanical 
safe and arm devices to 
protect motors from 
spurious electrical signals 
including those due to 
EMIandRFI 

Safe/arm relays in 
ignition circuit 

OPEN 


Shuttle 
damage or 
loss 

1.2 

Fire 

Electrical fault 
resulting in fire 

Design electrical circuits 
to minimize likelihood of 
fire 

Fire retarding 
cover on wiring 

OPEN 






Select propulsion system 
equipment that are resis- 
tant to combustion 

Because of H 2 O 2 

system design with 
low combustible 
materials 
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TABLE 6-1. - PRELIMINARY HAZARD ANALYSIS-SOLID PROPULSION SYSTEM - Concluded 


Hazard 

Ultimate 

effect 

m 

Intermediate effects 

Preventive action 

Scout status of 
implementation 

Electriical 

fault 

(continued) 

Shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system rupture or leak 

Thermal overpressur- 
ization of RCS system 
caused by fire in the 
vicinity of the system 

Provide nitrogen and 
hydrogen peroxide relief 
connections to the 
exterior of the shuttle 

OPEN 

Provide warning regarding 
personnel hazards to 
operating personnel 

Standard operating 
procedures contain 
warnings, cautions, 
and notes regarding 
RCS system hazards 

Corrosion 

Shuttle 
damage or 
loss 

1.4 

Shock, fragmentation, 
fire, chemical attack of 
materials, or toxicity 
resulting from RCS 
system leak 



Loss of RCS system 
structural integrity 

System materials are to be 
resistant to corrosion 

Materials selected 
to be compatible with 
H 2 O 2 

Provide warning regarding 
personnel hazards to 
operating personnel 

Standard operating 
procedures contain 
warnings, cautions, 
and notes regarding 
RCS system hazards 























ro 

05 



Notes: 

1. Q = "and” Gate 


FIGURE 6-1. - SOLID PROPELLANT ROCKET SAFETY CONSIDERATION TREE 
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FIGURE 6-2. - SAFETY ANALYSIS - PROGRAM ACTIVITY RELATIONSHIP 
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FIGURE 6-3. - SYSTEM SAFETY ANALYSES EVENTS AND MILESTONES 
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6. 1.2.2 Operating Hazard Analysis: This analysis us used by the contractor to provide the 
basis for the preparation of procedures for: 

1. Rendering the subsystem/system safe under normal and emergency conditions 

2. Emergency escape or egress and rescue operations 

3. Ground handling and transportation operations and environments 

4. Operating and maintenance operations, including warning and caution notes 

5. Identification of a hazardous period time span and actions required to 
control the identified hazard 

6. Recovery procedures for potential accidents. 

6. 1.2.3 Fault Hazard Analysis: This analysis is performed to monitor and control the design 
process in therms of system safety. This method/process uses established failure modes, failure rates, 
failure effects, and established hazard classifications. On complex systems, this analysis may be made 
up of several analyses accomplished on units which make up the configuration item. 

6. 1.2.4 Cable Failure Matrix: This analysis is a shorthand method used to concisely represent 
many of the possible combinations of failures which can occur within the cable assembly. The pre- 
dominant failure events depicted from the analysis are added to the Fault Hazard Analysis. 

6. 1.2.5 Fault Tree Analysis: This analysis provides a means for determining and graphically 
presenting the events or combinations of events which will cause a defined, undersired event. It also 
provides a basis for assessing the prbability of occurrence of these events, either by statistical or 
simulation methods. 

6. 1.2.6 Software Hazardous Effects Analysis: This analysis is performed on software to ensure 
that system interlocks and functional electromechanical controls are incorporated to prevent system 
functional hazards from being initiated by the software system. 

6.1.3 Scout Vehicle Description. - For the purpose of identifying the possible hazards and 
consequences associated with utilizing a solid propulsion system as a Shuttle payload, the upper stage 
of the Scout propulsion system were selected as a typical system. The Scout upper stage propulsion 
system, shown in Figure 6-4, consists of two solid rocket motor stages and associated attitude control 
and stabilization motors. The Antares 11 X259 is a composite modified double base solid propellant 
rocket motor (Department of Transport ation (DOT) Class A, Military Class 7) and is utilized for third 
stage propulsion. A hydrogen peroxide propellant reaction control system (RCS) is contained in the 
C-section and is used for attitude control. This RCS system uses four 48 lb thrust motors for pitch 
and yaw control during third stage burn. During coast, the 14 lb motors are throttled to 3 lbs for yaw 
and roll control and two 2 lb motors provide pitch control. The Altair III is a composite propellant 
solid rocket (DOT Class B, Military Class 2) and is used for fourth stage propulsion. This stage is spin- 
stabilized by composite solid propellant spin motors which are located on the D-section between the 
third and fourth stages. The vehicle may be configured with a variety of solid propellant spin motors, 
depending on the mission payload. 
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FIGURE 6-4. - SCOUT UPPER STAGE PROPULSION SYSTEM 



6.1.4 Space Shuttle System Description . - The Space Shuttle system, shown in Figure 6-5, is 
comprised of two composite propellant solid rocket boosters (DOT Class B, Military Class 2), the 
external propellant tank, and the Orbiter vehicle. The solid rockets are ejected at burn-out and are 
retireved by parachute for subsequent refurbishment and reuse. The external propellant tank is eject- 
ed before injection into orbit and is not retrieved. The main propulsion system is the three liquid 
rocket engines contained in the Orbiter. The solid rocket boosters augment main engine thrust during 
lift-off and early boost. 

6. 1.4.1 Mission Phases: Figure 6-6 shows the typical Orbiter vehicle mission phases examined 
in this study. The mission consists of launch pad operations, boost, orbit, payload deployment, de- 
orbit, and land or abort phases. 

6. 1.4.2 Launch Pad Operations: A typical ground flow is shown in Figure 6-7 and the 
associated time line is shown in Figure 6-8. As noted in the time line, the last thirty hours are 
launch pad operations. Figure 6-9 presents an expanded schedule of the launch pad operations. 

It was considered that during this phase, the Scout system would be brought to the pad and hoisted 
into the Orbiter in a vertical position. During the launch pad operation, the significant characteristics 
of the Shuttle/Scout system are as follows: 

•There is no propellant in the external tank or the Orbiter until the 
final ten hours 

•All explosive bolts, separation nuts, spin motors, and main rocket motor initiators 
in the Scout vehicle are removed until after the Scout is Installed in the Orbiter 

•The Scout nitrogen tanks are unpressurized and hydrogen peroxide tanks contain 
no fuel until after the Scout is Installed in the Orbiter. 

6. 1.4.3 Boost Phase: The boost phase consists of all operations from launch to Shuttle exter- 
nal tank separation. During this phase, the payload is subjected to the environment induced by the 
Shuttle, including thermal, pressure, shock, vibration, acceleration, and acoustic noise. During this 
phase, the significant configuration features are as follows: 

•The Shuttle's solid rocket boosters burn for approximately two minutes 
after launch pad ignition 

•The Shuttle's three main rocket engines operate from launch pad ignition 
until main engine cut out (MECO) before injection into orbit. At that 
time, the external tank Is separated from the Orbiter 

•The Scout payload separation nuts, explosive bolts, spin motors, and main 
rocket initiators are safed through safe-arm latching relays 

• All Scout batteries are uncharged 

•The Scout RCS fuel tanks contain hydrogen peroxide in expulsion bladders 
but the bladders are not pressurized. Pressure build-up is relieved through a 
pressure relief valve, decomposition chamber in the Scout vehicle and a 
bleed line in the Shuttle 

•The Scout nitrogen system upstream of the regulator is pressurized to 3000 psi 

• Orbiter pressure is equalized to ambient pressure through bleed ports 

• Orbiter payload bay doors are closed until orbit injection has been established. 
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FIGURE 6-6. - TYPICAL ORBITER VEHICLE MISSION PHASES 
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FIGURE 6-7. - KSC SPACE SHUTTLE SYSTEM GROUND FLOW 
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6. 1.4.4 Orbit Phase: The orbit phase begins with orbit injection and is terminated by de-orbit. 
Deployment of the payload occurs during this phase unless the deployment is aborted. The 
significant configuration characteristics of the orbit phase are as follows: 

• The Scout payload separation nuts, explosive bolts, spin motors, and main 
rocket initiators are not armed until after payload deployment 

• The Scout batteries are uncharged until all systems are checked and final 
count has commenced. 

• The hydrogen peroxide bladders are pressurized just prior to removal 
from the payload bay. 

6. 1.4.5 De-Orbit Phase: De-orbit normally occurs after the payload has been deployed. How- 
ever, de-orbit may occur after the mission has been aborted during the boost and orbit phases. The 
significant characteristics of the configuration are as follows: 

• Payload bay doors are closed, containing the Scout 

• Payload bay vents are opened after re-entry heating in order to equalize pressure 

• Scout nitrogen and hydrogen peroxide systems are dumped prior to de-orbit 

• The ignition system and all ordnance items are safed and the ignition batteries 
are discharged if they were charged during a deployment attempt. 

6. 1.4.6 Landing Phase: The landing phase may be necessary at any point in the boost phase 
and is necessary after de-orbit. The system is assumed to be in the safe condition as outlined in the 
de-orbit phase discussion. 

6.1.5 Shuttle/Scout Preliminary Hazard Analysis (PHA). - The Scout propulsion system PH A, 
which was conducted to identify hazards associated with the Space Shuttle/Scout concept, was devis- 
ed by first constructing a modified Fault Tree which descriptively is called a Safety Consideration 
Tree, submitted as Figure 6-1, and then completing the PHA of Table 6-1. The Safety Consideration 
Tree was used to effect an orderly examination of the concept so that all possible hazards associated 
with assembled solid rocket motors and interfacing hydrogen peroxide fueled reaction control sys- 
tems could be considered. Similar to the fault tree technique, the Safety Consideration Tree is 
constructed by examining the undersired event and then the causes of each event digressively until 
the hazard or intermediate hazard is identified. “OR” gates in the tree are assumed to exist where no 
gate is indicated and “AND” gates exist where indicated. 

The Preliminary Hazard Analysis, Table 6-1, is used to describe each of the possible hazards 
and the intermediate/ultimate effects identified in the Safety Consideration Tree. Also provided are 
safety requirements and Scout implementation techniques, as are available. A numbering system has 
also been utilized to simplify cross-reference between the Safety Consideration Tree and the PHA 
table. 


6. 1.5.1 Sources of Shuttle System Damage: The Scout propulsion system PHA addresses 
the possible Scout propulsion system hazards that can result in Shuttle damage or loss in the typical 
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Space Shuttle/Scout mission profile. The hazards and their associated consequences are considered 
to be those of a typical solid propulsion system. Shuttle system damage or loss due to the Scout 
propulsion system can occur as a result of premature solid rocket motor ignition, case rupture, 
detonation, fire, and chemical attack/toxicity; or explosion resulting from RCS system rupture or 
leak. The hazards which could cause these occurrences are designated by the bold outlined blocks 
in the Safety Consideration Tree and are listed in the "HAZARD'' column of the PHA. The number- 
ing system assists in cross reference. 

6. 1.5.2 Shuttle or Scout Non-Propulsion System Fire: A fire of the Shuttle or Scout system 
other than propulsion may be of such small magnitude that Shuttle damage does not directly result. 
However, it is possible for a fire of that magnitude to cause auto-ignition, explosion or detonation of 
a nearby motor which would result in Shuttle loss. A possible exception to that result is the pre- 
mature ignition of a spin motor. Spin motor ignition would not cause the pressure limits of the cargo 
bay to be exceeded, but Shuttle damage could result. This hazard is minimized by utilizing motors 
of high auto-ignition temperatures and also by using propellants that ignite rather than detonate in a 
fire. Scout motor auto-ignition temperatures are presented in the PHA. 

A fire in the Shuttle or Scout system, other than the propulsion system, which is too small 
to cause Shuttle damage directly or ignition of the motors may cause ignition of other materials 
thereby creating a fire of larger magnitude. The resulting fire may cause Shuttle system damage or 
loss directly and may cause premature motor ignition explosion or detonation. Battery acids from 
unsealed batteries can cause fires of this nature, however, this problem is eliminated by using squib 
activated-sealed batteries. Also spreading of a fire which is not propulsion system related can be 
minimized by using non-combustible materials. It should be noted that the payload bay has an inert 
atmosphere purging system to prevent this occurrence during the final stages of launch pad 
operation. Furthermore, in orbit the payload bay is in a vacuum so that an oxidizing material must 
be present in addition to a combustible material for a fire to propagate. 

Although a Shuttle or Scout non-propulsion system fire may not cause severe Shuttle damage 
or loss directly. Scout motor ignition or propulsion system fire, it could cause deterioration of the 
case or bond system which could result in a failure when the motor is ignited during the normal pay- 
load launch sequence. If fire of significant magnitude is detected in the vicinity of the motor prior to 
deployment, the launch can be aborted in order to prevent explosive rupture of the motor case. In 
any case, one basic requirement of payload launch is that sufficient distance between the payload 
and the Orbiter is obtained before any attempt is made to arm the system and ignite the first solid 
rocket motor. 

A fire in the Shuttle or Scout system can also cause overpressurization due to the temperature 
of the RCS system. Such overpressurization can lead to an RCS system leak or rupture resulting in 
release of hydrogen peroxide to the confines of the payload bay or the generation of tank fragmenta- 
tion and shock. The effects of leakage or tank rupture can cause Shuttle damage directly, may lead 
to premature ignition, explosion/deflagration of Scout motors, or cause a propagating fire. Over- 
pressurization of the RCS system is prevented by providing pressure relief connections for both 
nitrogen and hydrogen peroxide to the Shuttle exterior. In the Scout system, hydrogen peroxide 
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relief valve discharge is through a decomposition chamber to assure that the effluent fluid is not 
chemically hazardous. Further protection from hydrogen peroxide chemical hazards is afforded by 
including personnel warnings in the Standard Operating Procedures along with first aid information. 

6.1.5.3 Payload Propulsion System Fire: The effects of a Scout propulsion system fire are 
similar to those of a Shuttle or Scout non-propulsion system fire. A fire of the Scout propulsion 
system can result in Shuttle system damage directly, may cause premature ignition or motor 
explosion/deflagration or cause damage or bond degradation. The effects of a Scout propulsion 
system fire, therefore, are minimized or controlled in the same manner as the effects of a Shuttle 
or Scout non-propulsion system fire explained in the preceding paragraphs. 

6.1. 5.4 Environmental Temperature: The temperature environment of the Scout propulsion 
system will be a result of the cargo bay temperature in all phases of the mission except orbit phase. 
During that phase, the payload bay doors are open and the environmental temperature results from 
solar radiation, earth albedo, earth radiation, and space sink. 

Environmental heating of the payload may cause premature motor ignition or explosion/ 
deflagration, bond degradation, or overpressurization of the RCS system. If payload motor temper- 
atures rise to the point where auto-ignition or motor explosion/deflagration occurs, the Shuttle 
may be lost. This event can be avoided by adding insulation to the exterior of the motors, selecting 
and orbit missions which will limit the exposure time of the motors to solar heating or selecting 
motors whose auto-ignition temperatures are above the maximum expected temperature environment. 
Scout auto-ignition temperatures are presented in the PHA. 

Even though ignition or explosion/deflagration are avoided by selecting motors with a high 
auto-ignition temperature, the temperature resulting from environmental heating may cause case or 
bond degradation. This occurrence can be avoided by .utilizing motors that are designed and qualified 
for the expected maximum temperature environment. To reduce hazardous conditions the soli 
rocket motor ignition should be delayed until sufficient separation exists between the Orbiter and 

the payload. 

Environmental heating can cause overpressurization of a liquid or gas RCS system resulting in 
RCS system leak or rupture. Shock, fragmentation, chemical attack, or toxicity resulting from this 
occurrence may cause Shuttle system damage directly or Shuttle loss if premature motor ignition or 
explosion/deflagration occurs. RCS system overpressurization due to environmental heating is 
prevented by designing RCS system components to withstand the increased pressure resulting from 
the most extreme heat environment, providing sufficient insulation to the RCS exterior or selecting 
an. orbit mission which will limit the exposure time of the system to solar heating. The nitrogen and 
hydrogen peroxide storage reservoirs in the Scout vehicle have a proof pressure of 1.5 times operating 
pressure and a burst pressure of 2.5 times operating pressure. RCS pressure relief valve connections to 
the H 2 O 2 and N 2 systems are provided in the Scout System and must be vented to the Shuttle exterior. 
The hydrogen peroxide discharges through a decomposition chamber which minimizes chemical reac- 
tion of raw hydrogen peroxide. Furthermore, warning notes should be included in the Standard 
Operating Procedures in the event that environmental heat causes release of hydrogen peroxide in t e 
vicinity of personnel during launch pad operations. Qualification tests of the RCS system shou 
demonstrate the capability to withstand the expected environment. 
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6. 1.5.5 Meteoroid Impact: The meteoroid environment represents a projectile impact hazard. 
Meteoroid impact with a solid rocket motor may result in premature ignition, explosion, detonation, 
or case damage. Also, meteoroid impacts on the RCS system could cause an RCS system rupture 
or leak resulting in tank fragmentation, shock, fire, corrosion/reaction, or toxicity. The meteoroid 
impact hazard is present only during the orbit phase when the payload bay doors are open. An 
analysis, reference 64, has been conducted to determine the probability of meteoroid impact damage 
to the cases of the Antares X-259 and Altair III solid propellant motors in this environment. The 
analysis considers that only half the motor case area is exposed during the twenty-three hour orbit 
period, that the payload bay doors are open and additional deployment time of the vehicle before 
the first rocket motor Is ignited. With these assumptions, the probability of motor case damage is 
.0037; therefore, the probability of premature motor Ignition or detonation is small. Although this 
case damage probability is considered low, the effects of a case rupture hazard during solid rocket 
Ignition may be eliminated by delaying ignition until sufficient separation exists between the payload 
and the Orbiter or abort the launch. 

Meteoroid impact with RCS system components could cause RCS system leak or rupture 
resulting In tank fragmentation and shock, fire, corrosion/reaction, or toxicity. Such effects may 
cause direct Shuttle damage or may cause Shuttle loss indirectly by the resulting premature motor 
ignition or detonation. However, the Scout RCS system is completely enclosed within the transition 
section which is relatively invulnerable to meteoroid impact which minimizes this hazard. 


6. 1.5.6 Fragmentation From Non-Propulsion System Rupture or Explosion: Fragmentation 
damage similar to meteoroid impact damage may also be caused by a rupture or explosion of a 
Shuttle or payload system such as ignition batteries and oxygen tanks. Although this explosion or 
rupture may be of insufficient magnitude to cause significant Shuttle system damage directly, the 
fragments produced from this occurrence may cause premature solid rocket motor ignition, explosion/ 
deflagration or case damage and/or RCS system leaks or rupture. This hazard may be minimized by 
using qualification tests to demonstrate that the motors are insensitive to projectile impact. 

The solid rocket case or propellant bond damage can result In rupture of the motor case 
at ignition. This hazard is eliminated by aborting the mission. 

Fragments from an explosion may cause an RCS system rupture or leak resulting in further 
fragmentation, shock, fire, corrosion/reaction, or toxicity. In the Scout system, protection is 
afforded the RCS by the transition sections skin and other missile equipment. 

6.1. 5.7 Environmental Vibration: Vibration environment is of concern during the boost 
and landing phases of the Shuttle mission. The vibration environment produces energy that is 
absorbed by the solid propellant rocket motors which could result in propellant cracks or bond 
separation of the propellant grain. 

This type damage would result in an explosive rupture of the motor case upon ignition. 
Qualification tests should be used to demonstrate the motor's resistance to damage by vibration. 

Also, rocket motor ignition can be delayed until sufficient separation exists between the 
Orbiter and payload so that the Orbiter is not damaged by a rocket motor failure at ignition. 
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An RCS system leak or line rupture may result from vibration. Shuttle damage may result 
directly or indirectly from fire, corrosion/reaction or toxicity from H 2 O 2 . The RCS system should 
be designed and tested to the expected flight vibration so that this hazard may be eliminated. The 
RCS system components of the Scout vehicle have been qualified by tests and usage to demonstrate 
acceptance for Scout, however, the Scout environment must be compared to the Shuttle environ- 
ment and additional qualification testing may be required. 

6. 1.5.8 Environmental Shock: As presented in reference 65, the shock induced into the 
payload by the Shuttle system is only of major concern during abort landing and aborted-mode 
handling. The solid rocket motors should be tested to determine their ability to withstand the 
specified shock loads. 

Since the RCS system hydrogen peroxide and nitrogen pressure will be dumped for normal 
landing or abort landing there is no inherent hazard in this system during the landing phases. 

6. 1.5.9 Shock From Non-Propulsion System Rupture or Explosion: Mechanical shock or 
shock wave phenomena can result from a rupture or explosion in the Shuttle or payload systems 
other than the propulsion system. The magnitude of the shock may be insufficient to cause major 
Shuttle system damage directly, but It may result in Shuttle system damage indirectly by causing 
premature solid rocket motor ignition, explosion, detonation, case/propellant damage and RCS 
system rupture or leak. Premature motor ignition, explosion or detonation would result in Shuttle 
loss. This hazard can be minimized by demonstrating that the solid rocket motors are Insensitive 
to shock stimulus. Qualification tests should be conducted to a level beyond the expected shock 
resulting from the most severe non-propulsion system rupture or explosion. 


To eliminate the hazard which is inherent in motor case or propellant damage, the payload 
launch should be aborted or ignition should be delayed until safe separation exists between the 

Orbiter and the payload. 

An RCS system rupture or leak which is caused by shock may result in additional fragmenta- 
tion, shock, fire, corrosion/reaction, or toxicity. Minimization of this occurrence can be accomplished 
by qualification tests of RCS system components to the expected shock levels. The RCS system 
is normally protected from outside stimulus by the transition section skin, structure and other 

components. 

6.1.5.10 Electrical Fault: An electrical fault in the payload propulsion system can cause 
premature ignition of payload motors, fire, or RCS system rupture or leak resulting from over 
pressurization due to temperature. Since solid rocket motors are electrically initiated, a spurious 
electrical signal can cause premature motor ignition, resulting in most cases with Shuttle loss. 
Minimization of this hazard is accomplished by system design, operating procedures and pad safety 
procedures to ensure that no failure or operating errors will cause premature ignition. An electro- 
mechanical Safe and Arm device is the normal design feature which is employed to provide ignition 
train interruption. Squib shunts and electrical wiring shielding is also used to reduce or prevent 
RF signals from entering the ignition system. These devices prevent ignition due to component 
malfunction, radio frequency interference (RFI) and electromagnetic Interference (EMK). 
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A fire resulting from an electrical fault can cause Shuttle system damage and loss if premature 
solid rocket motor ignition, explosion/deflagration occurs. Minimization of this hazard is accomplished 
by selecting heat resistant and non-flammable materials in and around electric circuits. Also a 
nitrogen purge system is used in the payload bay to prevent an oxidizing atmosphere during the final 
stages of launch pad operations. The system operates in a vacuum during orbit. 

A fire resulting from an electrical fault can also cause thermal overpressurization of the RCS 
system resulting in a system leak or rupture. In addition to the safety provisions described in the 
previous paragraph, this hazard is minimized since there are pressure relief valves in the H2O2 and 
nitrogen systems. However, elevated temperature of an H2O2 tank without pressure build-up has 
resulted in an explosion during testing at the Vought Corporation, reference 66. 

6. 1.5.1 1 Corrosion: Corrosion of the RCS system components can result in an RCS system 
leak which may cause fire, corrosion/reaction, or toxicity. These effects can damage the Shuttle sys- 
tem directly or they can lead to more severe damage by causing a premature motor ignition, explo- 
sion, or detonation as a result of fire. Corrosion is prevented in the Scout RCS system by using 
components and tubing that are compatible with H2O2 3nd are resistant to corrosion. Also, personnel 
warnings are included in the Scout Standard Operating Procedures to inform personnel of the in- 
herent hazards of the hydrogen peroxide system and safety training is provided the technicians. 

6.1,6 RCS Propellant Selection. - Of primary concern in payload propulsion system design is 
the selection of the RCS system propellant. Since a variety of thrust magnitudes and burn times are 
desirable during a vehicle mission, the most feasible system is one using a liquid propellant. Hydrogen 
peroxide is utilized in the Scout Launch Vehicle to perform the “steering” function. Although 
hydrogen peroxide is hazardous to personnel and will react with a large variety of materials to gen- 
erate sufficient heat for combustion, its monopropellant qualities enhance control of hazards. 


Hydrazine is another monopropellant which has been used in upper stage RCS systems. 
Hydrazine (N2H4) vapors are flammable in all concentrations in air above 4.7 percent, reference 31. 
and is hypergolic with some oxidants such as hydrogen peroxide and nitric acid. Hydrazine is 
normally used as a monopropellant which is decomposed by a catalyst bed. Even though N2H4 is 
considered a storable propellant, precautions on corrosiveness and material compatibility must be 
adhered to. Other common RCS systems use bipropellants which are highly combustible and most 
frequently are hypergolic. Separate oxidizer and fuel storage is necessary which requires a more 
complex propellant system which reduces reliability and safety. These problems exist not only during 
flight but also during pre-launch fueling and checkout which requires two different sets of GSE for 
handling the fuel and oxidizer but requires additional safety and operating procedures. 

Liquid propellant hazards are discussed in detail in Section 6.2. 
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6.2 Liquid Propellants 


6.2.1 Introduction. — In reference 62, the Space Division of North American Rockwell per- 
formed a study for NASA, Manned Spacecraft Center, Houston, Texas. The study. Safety in Earth 
Orbit, examined specific safety issues regarding manned and unmanned payloads delivered to orbit by 
the Shuttle. The objective of one task of the study was to Identify hazards associated with specific 
Orbiter payloads while in earth orbit and to determine safety requirements and guidelines. Orbiter 
payloads which were considered In the study are as follows: 

• Agena 

• Centaur 

•Transtage 

•Apollo Service Module (SM) 

•Tug or Orbit-to-Orbit Shuttle (OOS) 

In references 67 and 68 the Agena/Shuttle and Space Tug Shuttle, respectively, were studied and 
specific considerations were given to hazardous situations for normal mission phases. The results 
from references? were used as the basis for the liquid system hazard study presented in this section. 


6.2.2 Hazardous Elements. - In most upper stage payload propulsion systems, the inherent 
safety hazards can be divided into three distinct areas of consideration; (1) high pressure gas systems, 
(2) ordnance devices, and (3) propellants. Hazardous elements which are utilized in.various propulsion 
systems can be further classified by the type of main propulsion propellant, type of pressurized 
container and gas, type of RCS propellants, corrosive fluids and attachment methods and/or pyro- 
technics. In reference 62 the six different payloads considered were presented in a comparison tab- 
ulation to show the many different hazardous elements that are contained in typical upper stages. 

This comparison is shown in Table 6-1 1. The Agena system uses a bi-propellant storable propulsion 
system with unsymmetrical dimethylhydrazine (UDMH) as the fuel and high density acid (HDA) as 
the oxidizer. HDA is a mixture of inhibited red fuming nitric acid (RENA) and nitrogen tetroxide 
(N2O4). The Agena inboard profile Is shown in Figure 6-10 and the propulsion system schematic is 
presented in Figure 6-11. The main tank pressurization is accomplished by helium gas stored at 
approximately 3600 psig. 


In reference 62 a hazard analysis of the Agena/Shuttle system was performed to identify the 
major hazards associated with each of the normal mission phases. 

Mission phases for a typical Tug payload, as given in reference 68, is outlined below. 


® 


® 

® 


Boost 

T ug free 

Recovery/ 

Preflight 

deploy 
0 

flight 
0 

entry 
0 

\ = 1 4e1ir 

t = 3.9 hr 

t= 24 hr 

t = 7 hr 


to 8.2 hr 

to 30 days 



Post- 
flight 

t = 6.5 hr (Safeing) 
t = 11 2.5 hr (T urnaround) 
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TABLE 6-11. — HAZARDOUS ELEMENTS OF UPPER STAGE VEHICLES 

Agena Centaur Transtage Burner 1 1 SM OQS/Tug |Toxicityj Fire I Corrosion I Explosion 


Pressurized containers and gas: 

Helium tanks 

Nitrogen tanks 

Nitrogen tetroxide tanks 

Aerozene -50 tanks 

Hydrogen peroxide tanks 

Liquid oxygen tanks 

Liquid hydrogen tanks 

Monomethyl hydrazine tanks 

Water/glycol tanks 

Unsymmetrical dimethyl hydrazine 

Inhibited red fuming nitric acid 

B = Can cause severe burns and 
tissue damage on contact with 
skin 


A = Simple asphyxiant 
X = Applicable or present 


(0) = Oxidizer 


(F) = Fuel 


A 

A 

See above 


See above 


C = Extremely toxic when heated to 
decomposition 

















145 


TABLE 6-11.- HAZARDOUS ELEMENTS OF UPPER STAGE VEHICLES - Concluded 



Agena 

Centaur 

T ran stage 

Burner 11 

SM 

OOS/Tug 

Toxicity 

Fire 

Corrosion 

Explosion 

RCS propellants; 











Aerozene -50 + nitrogen tetroxide 







C 

X 

X 

X 



X 


X 


C 

X 

X 

X 

Monomethyl hydrazine + 

nitrogen tetroxide 
Hydrogen gas + nitrogen tetroxide 







c 

X 

X 

X 

Pyrotechnics: 











Connections between modules- 





X 






cutters 











Helium valves 

X 


X 

X 







Solid propellant igniters 
Turbine start solid propellant 

X 










charges 

Explosive bolts - payload separation 

X 

X 

X 

X 

X 

X 





Linear shaped charge - panel separation 

X 

X 


X 

X 

X 





Destruct shaped charges 

X 

X 

X 

X 





External extensions - antennae 





X 






Rocket engines; 











(Qty. indicated) 











Main engine 

1 

2 

2 

1 

1 

1-4 





RCS Engine 


8 

12 

4 

16 

20 





Attachment methods: 











Explosive bolts 
Linear shaped charge 
Not defined 

X 

X 

X 

X 

X 

X 

i r\\ - r\. 


A 


:rkh\/viant 



B = Can cause severe burns and tissue 
damage on contact with skin 


to decomposition 


(F) = Fuel 


X = Applicable or present 









ox Pressure relief 





FIGURE 6-11. - AGENA PROPULSION SCHEMATIC 




The mission phases for payloads other than the Tug will normally involve only Phase 1 and 2. 

Mission Phase 4 could be required if the payload launch is aborted and the payload is returned to 
earth with the Orbiter. In the Agena study, reference 67, the sequence of events for normal opera- 
tion was divided into nine sets of operations. These operation sequence sets are shown in Table 6-1 II. 

6.2.3 Hazard Analysis 

6.2.3. 1 Payloads-Hazard Classes: In reference 67 individual hazards from all five payload 
systems, shown in Table 6-11, were analyzed. The individual hazards were screened and consolidated 

into fifteen classes of hazards. These hazard classes are as follows: 

1. Explosive/rupture of a pressurized container inside or near the Orbiter 

2. Combination of mutually reactive fluids inside or near the Orbiter 

3. Detonation of explosive charge inside or near Orbiter 

4. Rapid decomposition of monopropellants inside or near the Orbiter 

5. Uncontrolled combustion in an RCS engine inside or near the Orbiter 

6. Leakage of corrosive fluids inside the Orbiter 

7. Ignition of main rocket engine or RCS engine inside the Orbiter 

8. Attachment points of payload breaks Inside Orbiter 

9. Loss of attitude of payload near Orbiter 

10. Hang-up of payload during release from the Orbiter 

1 1 . Rupture of common bulkhead tanks of payloads in or near the Orbiter 

12. Loss of pressurization in RCS system while in or near the Orbiter 

13. Inability to dump propellants or pressurants during orbiter boost phase abort 

14. Inability to dump propellants or pressurants of retrieval payloads 

15. Inability to close cargo bay doors because of interference with the 
payload in the Orbiter bay. 

Items 3, 8, 9, 10, 13, 14, and 15, almost 50 percent of the hazard classes, pertain to problems/failures 
which do not pertain directly to the propellants, propellant containers, or engines. However, the 
hazards do pertain indirectly to the propulsion system since the occurrence of the listed hazardous 
situations could cause damage to the payload/Orbiter which would result in fire, explosion and 
corrosive/toxic situations. 

The Agena hazard analysis, reference 67, was divided into basically four parts as follows. 

1. Hazard Diagrams (Safety Consideration Tree) 

2. Hazard Review of Normal Operational Sequence of Events 

3. Hazard Review of the Abort Sequence 

4. Compilation of Potential Hazards 

6.2. 3.2 Hazard Diagrams: In the Agena study, as well as the study of reference 62, it was 
concluded that the four major categories of hazards which would be detrimental to the payload/ 

Shuttle system and personnel were: 

• Fire/Explosion 

• Collision 

• Contamination 

• Toxicity 
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TABLE 6-IU. - NORMAL OPERATIONAL SEQUENCE 


Event No, 

Sequence 

1.0 

Readiness area final loading and pressurization 

1.0.1 

Install pyro devices 

1.0.2 

Install batteries. Initiate battery monitoring. Do not switch to 
battery power 

1.0.3 

Transfer/load propellants. Activate leakage detection equipment 
and procedures 

1.0.4 

Fill He and N 2 bottles to flight pressures 

1.0.5 

Pressurize fuel and oxidizer tanks in sequence to launch pressures 

1.0.6 

Maintain safety monitor of temperatures, pressures, leaks, electrical 
power circuits, valve positions 

1.1 

Move Agena to Orbiter 

1.1.1 

Disconnect and cap propellant dump lines 

1.1.2 

Attach slings, cables, etc., and rotate Agena to horizontal attitude using 
overhead crane 

1.1.3 

Move Agena to transporter and mate in horizontal attitude 

1.1.4 

Transport Agena to Orbiter site 

1.2 

Mate Agena to Orbiter 

1.2.1 

Attach hoisting/handling equipment to support cradle 

1.2.2 

Unlatch and disconnect Agena/cradle from transporter 

1.2.3 

Hoist Agena/cradle, translate to Orbiter, and insert in payload bay 

1.2.4 

Secure cradle to Orbiter tiedown fittings 

1.2.5 

Connect dump lines to Orbiter propellant dump system 

1.2.6 

Connect power and instrumentation systems to Orbiter 

1.2.7 

Monitor safety instrumentation systems to Orbiter 

1.3 

Erect Orbiter and move to launch pad 

1.4 

Conduct pre-launch pad activities 

1.4.1 

Monitor safety and status instrumentation 

2.0 

Launch, ascent, and orbital quiescence 

2.0.1 

Monitor safety and status instrumentation 

2.1 

Pre-deployment activities 

2.1.1 

Transfer from Orbiter to internal Agena power 

2.1.2 

Attach manipulator arm to Agena 

2.2 

Deployment activities 

2.2.1 

Disconnect umbilicals for electrical power, fuel dump/vent and oxidizer 
dump/vent at Agena/cradle interface and retract lines 

2.2.2 

Unlatch and release Agena from support cradle 

2.2.3 

Deploy Agena/payload with manipulator 

2.2.4 

Command Agena telemetry ON via RF command link, and check RF 
link and telemetry are GO 

2.2.5 

Release and withdraw manipulator from Agena/payload 

2.3 

Separation activities 

2.3.1 

Move Orbiter away from Agena to prescribed distance 

2.3.2 

Activate Agena attitude control system by command 

2.3.3 

Arm Agena pyros and engine start cans by command, and start 
computer-controlled operational program. 
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Each of the major categories was analyzed by Lockheed Missile and Space Company (LMSC) by 
preparing hazard diagrams (similar to the solid rocket Safety Consideration Tree in Section 6.1), 

These four diagrams are presented in Figures 6-12 through 6-15. The events shown in these figures 
which are not enclosed in blocks were added for the present study. The events which are enclosed 
in bold blocks are those hazards that LMSC identified as being of major importance and required 
counteraction by design/testing, operation, procedure or equipment. The tabulation of the hazard 
analyses is presented in Table 6-1 V. 

6.2.3.3 Hazard Review - Normal Operational Sequence of Events: The operation sequences. 
Table 6-111, were screened to determine the most likely potential hazards. The results of this screen- 
ing process are shown in Table 6-V. As shown, there were only ten operational events which 
survived the hazard screening process. 

6.2.3.4 Hazard Review - Abort Sequence: Table 6-VI presents the assumed abort sequence 
for the sequential dump of oxidizer and then fuel. Presented in Table 6-VI I is the hazard analysis 
for the abort sequences. 

6.2.3.5 Hazard Analysis Summary: A compilation was made by LMSC on their Agena system 
based on each of the hazard analyses. The more significant hazards, the potential effects and proposed 
control were summarized and are presented in Table 6-VI II. In Table 6-VI 1 1 under 'HAZARD 
EFFECTS', the likelihood of occurrence is rated as certain, likely, possible, unlikely, and very 
unlikely. Those potential hazardous conditions which are classified ascertain, likely, and possible 

are listed and the likelihood of the condition existing is placed in parentheses. 

1. Propellant on-board for landing (unlikely) 

2. Oxidizer tank implosion with residuals present (possible) 

3. Propellant tank rupture/projectile penetration of tank (unlikely) 

4. Explosive mixture In dump lines (possible) 

5. Personnel errors (prevented by design) 

6. Oxidizer and/or fuel in payload bay (unlikely) 

7. Mixing of fuel and oxidizer (unlikely) 

8. Agena partially disconnected — deployed or damaged (unlikely) 

As can be seen from the above listing, only items 2 and 4 are shown as possible residual 
hazardous conditions. To reduce all hazardous conditions to this minimum level, the following 
preventive actions were outlined by LMSC: 

OxidIzer/Fuel Dumping 

(a) Redundant electrical system 

(b) Leave oxidizer dump valve open following dump 

(c) Eliminate bends and risers in dump lines 

(d) Use inert gas purge in dump lines 

(e) Use check valves on cradle side of dump line interface 

(f) Redundant helium valves 

(g) System designed to prevent inadvertent valve openings 

As can be seen from the above listing, the elimination of hazardous conditions in liquid 
systems requires good system design, trained personnel, safe procedures and safe handling equipment. 


150 



151 



Branch a 



Fuel leak in 
presence of heated 
atmosphere, static 
discharge, short cir- 
cuit or metal oxide 




Fuel ox-pressure 
reversal 


Battery 

internal 

failure 


■Excess 

pressure 


Fuel tank 
pressure drop 


Fuel line, 
valve or 
seal leak 
plus ox-vent 
failure 


Ox-tank press, 
reg. failure, or liquid 
in vent line 


Defective or 
contaminated 
press, regulator 
plus He valve 
command failure 


Excessive press. 

head from 
crash landing 
( tanks full) 


Excessive 

landing 

accelerations 


AD HOC Safety Group 
Reference 69 
Section 5.0 
Paragraph 5.1 
Item 9 

Eliminates usage 

of nested tanks 

with common bulkheads 


1 nadvertent 
fuel dump 


Personnel 


Stray elec, 
signal 


Automatic 

dump 

sequence 

failure 


Fuel tank 
rupture 


Excessive 

structural 

loads 


Excessive 
pressure head 
from crash 
landing (tank full) 

Fuel tank 
press, reg. 
failure plus 
He valve com- 
mand failure 


Collision 


Pressure 

vessel 

rupture 


Faulty 

pressure 

vessel 


Collision 

Excessive 

temperature 


‘ Excess 
pressure 


Residuals in 
fuel dump line 
plug ignition 
source 


Bends and rises 
in fuel dump 
lines, plus fuel 
dump during 
shuttle abort 



Excessive 

landing 

accel. 


Defective or 
contaminated 
pressure 
regulator 


Improper deployment 
or ground handling 
procedure 


Added in this study 


j ^ rtooeo 1 


FIGURE 6-12. - FIRE/EXPLOSION HAZARD DIAGRAM 


























Branch a 


2.1 

1 1 

Ground 

handling 

error 


ACS 

failure 


FIGURE 6-13. 


Collision 



COLLISION HAZARD DIAGRAM 
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3.0 



FIGURE 6-14. - CONTAMINATION HAZARD DIAGRAM 
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FIGURE 6-15. - TOXICITY HAZARD DIAGRAM 














TABLE 6-IV. - AGENA PRELIMINARY HAZARD ANALYSIS 


Hazard 


Fire/explosion 


Intermediate 

effect 


Rupture of common 
bulkhead in propellant 
tank 


Hazard 

branch 

number 



1.1. 1.3 


1.1. 1.4 


Hazard cause 


Fuel pressure leak plus oxidizer vent 
failure will cause pressure differential 
in tanks 



Failed open oxidizer pressure 
regulator, plus oxidizer vent failure 
plus helium valve command failure 
will cause overpressurization 


Excessive crash landing loads could 
cause excess loads on full propellant 
tanks 


Inadventent fuel dump could cause 
bulkhead failure and fire 


Fuel tank rupture could result in fire 


Counteraction 


1. Dual failure required 
before fire can occur i 

2. Component qualification ' 
and inspection 

3. Safety monitor can 
increase fuel tank 
pressure by command 


1. Triple failure required 

2. Component qualification, 
inspection and test 


1. No hazard unless accel- | 
eration or shock loads 
exceed design 

2. Dump propellants 
before landing 


1. Prevented by fail-safe 
system design and 
personnel training 


1. Control acceleration 

2. Dump propellant before 
landing 

3. Component qualification, 
inspection and testing 

4. Fail-safe procedures 
and equipment 


oi 

cn 
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TABLE 6-IV. - AGENA PRELIMINARY HAZARD ANALYSIS - Continued 


Hazard 

Intermediate 

effect 

Hazard 

branch 

number 

Hazard cause 

Counteraction 

Fire/ex plosion 
(continued) 

Oxidizer leak plus 
combustibles in payload 
bay 

1.2 

Oxidizer combined with organic 
material may spontaneously ignite 

1. Provide leak-tight pro- 
pellant system 

2. Provide helium purge bay 

3. Keep combustible 
materials out of 
payload bay 

4. Dump oxidizer if large 
leak occurs 


Fuel leak in presence of 
heated atmosphere, 
static discharge, short 
circuit, or metal oxide 

1.3 

Fuel combined with atmosphere and 
ignition may burn 

1. Provide leak-tight pro- 
pellant system 

2. Provide helium purge bay 

3. Keep metal oxides out 
of payload bay 

4. Purge payload bay with 
inert gas while on ground 

5. Control payload bay 
temperature 

6. Eliminate ignition source 

7. Dump propellant 


Battery overtemp 

1.4 

Overheated batteries can explode 

1. Use overload devices for 
short circuit 

2. Design, qualification, 
inspection, testing 

3. Use current practices to 
prevent battery explosion 

4. Use debris shield around ' 
battery 




TABLE 6-IV. - AGENA PRELIMINARY HAZARD ANALYSIS - Continued 


Hazard 

Intermediate 

effect 

Hazard 

branch 

number 

Hazard cause 

Counteraction 

Fire/ 

explosion 

(continued) 

Pressure vessel rupture 

1.5 

Pressure vessel rupture could be quite 
hazardous, damaging propellant tanks, 
equipment and shuttle, and injuring 
personnel 

1. Control temperature 

2. Depressurize tanks before 
landing 

3. Certify tanks by design/ 
test 

4. Maintain ultimate safety 
factor of 2.0 

5. Protect tanks from impact 
or collision 

6. Use debris shields 


Residuals in fuel dump 
line, plus ignition source 

1.6 

Fuel trapped in an open dump line 
following abort 

1 . Design dump lines for 
gravity drain 

2. Close dump line exit on 
landing 

3. Keep ignition sources 
away from orbiter 

4. Purge dump lines 


Crack or leak in 
common bulkhead 

1.7 

Fuel and oxidizer mix through 
cracks causing reaction 

1. Apply manufacturing, 
testing and inspection 
techniques that are 
proven 

2. Maintain tank AP 
within required limits 

Collision 

. 1, 1 ■ ' ' 

1. Damage to Agena 
or Orbiter 

2. Propellant leaks 
and fire/explosion 

2.1 

1. Ground handling errors or equipment 
failure 

1. Develop procedures for 
equipment and ground 
handling 

2. Train personnel 
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TABLE 6-IV. - AGENA PRELIMINARY HAZARD ANALYSIS - Continued 


Hazard 

Intermediate 

effect 

Hazard 

branch 

number 

Hazard cause 

Counteraction 

Collision 

(continued) 


— 

2.2 

1. RCS motors fire out of control 
or fail during deployment 

1. Establish adequate sepa- 
ration between Orbiter 
and Agena before 
activating Agena ACS 

2. Redundant ACS compo- 
nents prevent loss of 
control 



2.3 

1. Premature main engine ignition 

1. Inhibit engine firing until 
arm command is given 
following adequate separa- 
tion between Orbiter and 
Agena 



2.4 

1. Manipulator failure 

2. Operator error 

3. Premature release of Agena 

1. Design Agena cradle so 
that mission specialist 
must command release 

2. Manipulator failure and 
operator error are the 
responsibility of the 
shuttle system 

Contamination 

1. Ground and streams/ 
rivers polluted 

3.1 

1. Failure to dump propellant at 
high altitude 

1. No dumping below 
2000 feet 

2. Schedule dump at proper 
time 


1. Payload bay- 
Agena payload 
damaged 

2. Fire/explosion 

3.2 

1. Propellant leaks in closed 
payload bay 

1. Provide leak-tight pro- 
pellant system 

2. Purge payload bay with 
inert gas while on ground - 
vent in flight 




TABLE 6-1 V. - AGENA PRELIMINARY HAZARD ANALYSIS - Continued 


Hazard 


Contamin- 

ation 

(continued) 


Intermediate 

effect 


1. Payload bay, Agena 
payload, GSE 
damaged 


1. Orbiter, Agena 
payload, GSE, facility 
damage 

2. Personnel injury or 
death 


1. Orbiter damage 

2. Orbiter, Agena 
payload damage or 
fire 


Hazard 

branch 

number 


3.3 


3.4 


3.5 


Toxicity 


1. Toxic fumes near 
ground 

2. See 3.1 


1. Toxic environment 
in payload bay 

2. See 3.2 


4.1 


4.2 


Hazard cause 

1. Propellant leaks during ground 
handling 


1. Propellant spills during fueling 
process 


1. Propellants contact aft end of 
orbiter during dumping process 

2. Propellants enter vents during 
dumping of propellants 


1. Failure to dump propellant at 
high altitude 


1. Propellant leaks in closed 
payload bay 


Counteraction 


1. Provide leak-tight pro- 
pellant system 

2. Develop ground handling 
equipment and procedures 
to avoid damage to lines, 
fittings and seals. 

1. Use fail-safe fill equip- 
ment and procedures 

2. Provide large quantities 
of water to dilute and 
wash away propellant 

3. Observe safety practices 

4. Train personnel 

1. Provide safe dump exit 
design and location 
through development and 
test 

2. Dump propellants while 
vents are closed 

1. No dumping of pro- 
pellants below 2000 ft 

2. Schedule dump at 
proper time 

1. Provide leak-tight 
propellant system 

2. Purge payload bay with 
inert gas while on ground- 
vent in flight 
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TABLE 6-IV. - AG ENA PRELIMINARY HAZARD ANALYSIS - Concluded 


Intermediate 

effect 


1. Toxic environment 
in vicinity of Agena 

2. See 3.3 


Hazard 

branch 

number 




1. Injury/death to 
personnel 


1. Injury/death to 
personnel 


Hazard cause 


1. Propellant leaks during ground 
handling 



1. Residuals at dump line exits or 
disconnects 


1. Propellant spills during fueling 
process 


Counteraction 


1. Provide leak-tight pro- 
pellant system 

2. Develop ground handling 
equipment and procedures 
to avoid damage to lines, 
fittings and seals 

3. Provide propellant leak 
detectors and monitor 


1. Design dump lines for 
gravity drain following 
landing 

2. Cover dump exits until 
line purge 

3. Purge lines before 
disconnecting or working 
around dump exits 


1. Use fail-safe fill equipment 
and procedures 

2. Provide large quantities of 
water to dilute and wash 
away spilled propellant 

3. Observe safety practices 

4. Train personnel 








Potential hazard 
identification 


TABLE 6-V. - OPERATIONS SEQUENCE EVENT SCREENING 
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Release from transporter 
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Move to payload bay 
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EB 
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Secure cradle to Orbiter 
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■ 
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B 

B 
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Connect dump lines 
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B 
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Connect power and instrumentation 
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Monitor safety via Orbiter 
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Erect and move to pad 
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Monitor safety and status 
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■ 
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Launch to orbit 


■ 

H 

H 

■ 





■ 

■ 

^D 

1 


■ 

■ 


■ 

B 

B 


■ 
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B 
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1 
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i 

1 

1 


8 

21 

Deployment activities 
Disconnect umbilicals 
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1 
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X 

1 

X 

1 

a. No disconnect 

b. Partial disconnect 

c. Propellant leaked 
into dump lines 

X 


X 
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1 
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1 

1 
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Release from cradle 
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ID 
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Shuttle responsibility 
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■ 

IB 

X 

■ 
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■ 

■ 

H 

■ 

■ 

B 
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fl 


i 

1 

B 
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Release Agena 
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1 

X 

X 

1 

X 

■ 

1 

■ 

B 

■ 

B 

1 

Arm not released 
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B 

D 
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B 

B 

Shuttle responsibility 

9 
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Separation activities 
Move Orbiter away 
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Shuttle responsibility 
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TABLE 6-VI. - SEQUENTIAL DUMP - OXIDIZER FOLLOWED BY FUEL 


Event 

number 

The following actions are taken by the mission specialist after initiation of 
shuttle abort 

1. 

He monitors shuttle acceleration and flight path and when SRM and main engine 
thrust is terminated, and the Orbiter is descending through the atmosphere 
with drag force resulting in a net propellant settling acceleration of 0.003g 
or greater, he arms the abort system and depresses an abort button to initiate the 
following programmed sequence 

2. 

Open He and N2 control valves to pressurize fuel and oxidizer tanks 

3. 

Open the oxidizer forward dump valve 

4. 

When the oxidizer dump valve has been open 90 sec or more and tank pressure 
drops below 27 psi, close the He control valve supplying the oxidizer tank 

5. 

Open the fuel forward dump valve 

6. 

When the fuel tank dump valve has been open 40 sec or more and pressure 
drops below 35 psi, close the fuel forward dump valve 

Landing 

7. 

Land 

Post landing 

8. 

Connect fuel and oxidizer vent lines to GSE, reduce fuel tank pressure, close 
oxidizer dump valve, and purge dump lines 

9. 

Disconnect dump lines and electrical umbilical at Orbiter interface and 
release support cradle from Orbiter tiedowns 

10 . 

Remove Agena/payload arid cradle from payload bay and install in transporter 

11. 

Remove pyros 

12 . 

Purge propellant tanks and lines through GSE 

13. 

Transport to refurbishment facility 
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TABLE 6-VII. - HAZARDS ANALYSIS FOR ATMOSPHERIC ABORT 


Event 

No. 

Potential hazard 

Counteraction 

1 

Abort button pushed before propellants 
settled, resulting in possible loss of 
pressurant and failure to dump propellant. 
No hazard for normal entry and landing, 
if fuel tank remains pressurized 

1. Provide accurate acceleration in- 
formation to mission specialist. 

2. Consider putting an accelerometer 
switch in the circuit to inhibit 
dump if propellants are not settled 

2 

a. He and/or N 2 control valves fail to open. 
Oxidizer and fuel only partially dump 
and tanks will not repressurize 

b. Fuel or oxidizer pressure regulator fails 
open 

a-1 Parallel redundant valves preclude 
single point failure 
a-2 Inhibit dump valve until He 
valve is open 

b-1 Pressure controller modulates the 
corresponding fuel or oxidizer 
pressure control valve 

3 

Oxidizer forward dump valve fails to open. 
Oxidizer does not dump 

1 . Mission specialist can command oxi- 
dizer aft dump valve open and dump 
1/2 of oxidizer load. Mission 
specialist must have indication of 
valve positions 

4 

He control valve to oxidizer tank fails to 
close. Pressurant is lost at a rapid rate. Fuel 
cannot be dumped 

1. Inhibit fuel dump valve from opening 
while He control valve to oxidizer 
tank is open. Land with fuel 

5 

Fuel forward dump valve fails to open. 
Fuel does not dump 

1. Mission specialist can command aft 
dump valve open and dump 1/2 of 
fuel load. Mission specialist must 
have indication of valve positions 

6 

Fuel dump valve fails to close. Pressurant 
is lost at a rapid rate. Tank cannot be 
repressurized 

1. Land with both fuel and oxidizer 
tanks open to the atmosphere 

7 

No hazard on landing unless design crash 
landing loads exceeded, or residuals are 
trapped in fuel dump line 

1. Keep ignition sources away from 
fuel dump exit following landing 

8 

Careless handling of propellant systems 
after landing could expose personnel 
to toxic propellants 

1. Adequate procedures, equipment, 
and training 

9 

No hazard in disconnecting umbilicals if 
durnp lines properly purged and tanks 
vented in previous step 

1. Verify dump lines purged and 
tanks depressurized 

10 

Collision or impact if removal of Agena 
to the transporter is not properly handled 

1. Adequate procedures, equipment, 
and training. Use extra care if tank 
partially or fully loaded 

11 

No unique hazards during removal of pyros 

1. Use trained personnel and adequate 
procedures 

12 

Toxicity, contamination, fire, if tank and 
line purge not properly handled 

1. Adequate procedures, equipment, 
and training 

13 

No hazard if transport is properly handled. 
Collision with careless handling 

1. Adequate procedures, equipment, 
and training 
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TABLE 6-Vlll. - 


Hazard identification 


Error, malfunction; 
undesired event 

Cause 

Potentially hazardous 
condition 

Potential 

consequences 

Dump initiated with 
propellants not 
settled, and system 
not designed to land 
fully loaded 

Human error 
or indicator 
error 

Pressurant lost; pro- 
pellant not dumped 

Tank rupture 
on-8g crash 
landing re- 
sulting fire 

Dump system con> 
trol failure and system 
not designed to land 
fully loaded 

Electrical 
failure or 
component 
failure 

Propellant on-board 
for landing 

tank rupture 
on-8g, crash 
landing re- 
sulting in fire. 
Propellant in 
tanks during 
soft landing 

Dump system 
control failure 

Oxidizer 
tank closed, 
but not 
repressur- 
ized for 
entry and 
landing 

Oxidizer tank implo- 
sion with residuals 
present 

i 

Contamination, 

toxicity 

Propellant spills 
during ground vent 
and line purge, tank 
drain following 
abort landing 

Human 

error 

Presence of toxic 
propellants 

Toxicity 

Collision during 
ground handling 

Equipment 
failure or 
human 
error 

Propellant tank 
rupture 

Fire, toxicity, 

contamination, 

injury 

Crash landing plus 
depressurized fuel 
tank, with full 
propellants 

Excessive 

loads 

Common bulkhead 
rupture 
** 

Fire 


(a) Catastrophic; (b) Critical; (c) Controlled 
5|c sft Common bulkhead tanks not used on 
shuttle payloads 


HAZARD ANALYSIS SUMMARY 


Hazard effects 

Control actions 

Hazard* 

Likelihood of occurrence 

Preventive actions 

Corrective/remedial 

actions 

class 

Condition 

Consequences 

a 

Unlikely 

Very unlikely 

Provide accurate accel- 
eration info to 
mission specialist 

Stop dump before 
pressurant lost, 
and restart 




Put accelerometer 
switch in line to 
inhibit premature 
dump actuation 


a 

Possible 

Likely 

Redundant electrical 
system 

Redundant He valves 

Use special care on 
landing 

c 

Possible 

Very unlikely 

As above 

Special care on 
landing and post 
landing 

b 

Possible 

Possible 

Leave ox dump valve 
open following dump. 
Parallel redundant 
press. Control valves 

None 

b 

Unlikely 

Unlikely 

Procedures, equip- 
ment, and training 

Remove personnel 
plus water deluge 

a 

Unlikely 

Possible 

Fail-safe handling, 
equipment safe pro- 
cedures, trained 
personnel 

Remove personnel 
plus water deluge 

a 

Very unlikely 

Certain 

Special care on landing, 
retain pressurization 
gas to maintain fuel 
tank pressure 

None 
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TABLE 6-Vlll. - HAZARD ANALYSIS SUMMARY - Continued 


Hazard identification 

Hazard effects 

Control 

actions 

Error, malfunction; 
undesired event 

Cause 

Potentially hazardous 
condition 

Potential 

Hazard * 

Likelihood of occurrence 

Preventive actions 

Corrective/remedial 

consequences 

class 

Condition 

Consequences 

actions 

Pressure regulator 
fails open during 
propellant dump 

Faulty regu- 
lator 

Tank or common 
bulkhead rupture 
* * 

Fire, contamina- 
tion 

a 

Possible 

Likely 

Use high reliability 
regulators. High 
system cleanliness. 
Use materials inert 
to propellants 

Pressure controller 
modulates pressurant 
valve to control pres- 
sure. Oxidizer relief 
valve opens 
automatically 

Residuals remain in 
fuel dump line 

Dump line 
rises and 
bends, in- 
adequate 
purge 

Explosive mixture in 
dump line 

Explosion, if 
ignition source 
is present 

a 

Possible 

Possible 

Eliminate bends and 
rises in dump line. 
Provide reliable 
purge with inert gas 

Keep ignition sources 
away from fuel dump 
exit. Cap exits follow- 
ing landing until lines 
are purged 

— 

Fuel pressure leak and 
oxidizer vent failure 

Faulty 

components 

Common bulkhead 
rupture 
* * 

Fire 

a 

Unlikely. Dual 
equipment 
failure required 

Certain 

High reliability parts 

Open fuel tank He 
valve to maintain 
tank pressure 

Fuel tank overpres- 
surized or punctured 
during abort or 
landing 

Collision, 
excess 
loads, or 
failure of 
both fuel 
press, reg. 
and He 
valve 
command 

Fuel tank ruptured 

Fire 

a 

Unlikely. Out- 
of spec loads or 
dual equipment 
failure required 

Likely 

Care in handling. High 
rel parts. Fail-safe 
design. Dump 
propellant before 
landing 

Command fuel vent 
open to reduce 
pressure 

Inadvertent fuel 
dump 

Common 

bulkhead 

rupture 

Personnel error 

Fire 

a 

Prevented by 
design 

Possible 

System design requir- 
ing deliberate action 
to arm, open He 
valves, and open dump 
valves, plus fuel dump 
inhibit if ox dump 
valve is not open 

Command dump valve 
closed 

Oxidizer leak 

Faulty seal 

Oxidizer in payload 

■ 

a 

Unlikely, based 
on Agena 
history 

Possible 

Redundant seals, high 
rel parts, inspection, 
careful handling, 
absence of organic 
materials in payload 
bay 

Inert purge of payload 
bay while on the 
ground. Dump 
oxidizer 


* (a) Catastrophic; (b) Critical; (c) Controlled 


* * Common bulkhead tanks not used on 
shuttle payloads 
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TABLE 6-Vlll. - HAZARD ANALYSIS SUMMARY - Concluded 


Hazard identification 

Hazard effects 

Control 

actions 

Error, malfunction; 
undesired event 

Cause 

Potentially hazardous 
condition 

Potential 

consequences 

Hazard * 

Likelihood of occurrence 

Preventive actions 

Corrective/remedial 

actions 

class 

Condition 

Consequences 

Fuel leak 

Faulty seal 

Fuel in payload bay 

Fire, contamina- 
tion 

a 

Unlikely, based 
on Agena 

Possible 

Redundant seals, high 
rel parts, inspection, 
careful handling, 
absence of metal 
oxides in payload bay 

1 nert purge of payload 
bay while on the 
ground. Dump 
propellants 

Battery explosion 

Internal 
failure or 
short 
circuit 

Propellant tank 
penetrated by debris 

Explosion and 
fire 

a 

Unlikely 

Unlikely 

Fail-safe battery design. 
Qual test, short 
circuit protection. 
Debris shields 


Pressure vessel 
rupture 

Faulty 

pressurant 

tank 

Propellant tank 
penetrated by debris 

Fire, contamina- 
tion, toxicity 

a 

Unlikely 

Possible 

Flight qua!., factors 
of safety 2.0, 
inspection 


Propellant tank 
rupture 

Faulty pro- 
pellant 
tank 

Propellant released 

Fire, contamina- 
tion, toxicity 

a 

Unlikely 

Possible 

Flight qual., inspec- 
tion, factor of 
safety 1 .4 

Water deluge if 
prelaunch 

Crack in common 
bulkhead 

* * 

Faulty 

tank 

Comingling 
of fuel and ox 

Fire 

a 

Unlikely 

Certain 

Manufacturing testing, 
and inspection tech- 
niques currently used 
on Agena, maintain 
AP within specs 


Dump lines wet 
during disconnect 
in orbit 

Propellant 
dump valve 
leak or 
propellant 
vent 

Propellant released 
into payload bay 

Fire, contamina- 
tion corrosion 

a 

Possible 

Possible 

Purge lines before 
disconnect. Check 
valves on cradle side 
of line interface 


Unsuccessful 
deployment in orbit 

Equipment 
failure or 
handling 
error 

Agena partially 
disconnected or de- 
ployed, or damaged 

Orbiter-cannot 
safely reenter 

a 

Unlikely 

Possible 

Redundant release 
mechanisms and 
fail-safe restraints 

EVA to release or 
reconnect 


(a) Catastrophic; (b) Critical, (c) Controlled 


* * Common bulkhead tanks not used on 
shuttle payloads 




The main concern is to provide an acceptable environment (temperature, shock, vibration, impact, 
overpressurization) which will prevent the fuel and oxidizer from leaking or mixing in any form 
except In the engine combustion chamber. 

Tank Rupture 

(a) Redundant electrical system 

(b) Use parallel redundant tank pressure control valves 

(c) Use fail-safe handling, equipment, procedures, trained personnel 

(d) Use high reliability regulators 

(e) Dump fuel/oxidizer before landing 

(f) System design to prevent inadvertent valve opening 

(g) Use high factor of safety on tank design 

Propellant Leakage 

(a) Use fail-safe handling, equipment, procedures, trained personnel 

(b) Use redundant seals in valves and closures 

(c) Do not allow metal oxides or organic materials in the payload bay 
which react to propellant 

(d) System designed to prevent inadvertent valve openings 

(e) Use check valves on cradle side of dump line interface 

Payload Release 

(a) Use redundant release mechanism 

6.2,4 Liquid Propellants. ~ The hazardous and unique characteristics of liquid oxidizers and 
fuels, taken from references 6, 70 and 71 are presented below. A summary of the characteristics are 
presented in Table 6-1 X. 

6.2.4.1 Unsymmetrical Dimethyl Hydrazine (UDMH): UDMH is a clear, colorless liquid 
with a sharp ammoniacal or fishy odor. It is a fuel which is flammable In air over a very wide range 
of concentrations. It is hypergolic with some oxidants, including fuming nitric acids, nitrogen 
tetroxide, hydrogen peroxide, chlorine trifloride, and fluorine. Rags, cotton waste, wood scraps, 
excelsior, and other materials of large surface area that have absorbed UDMH may cause spon- 
taneous ignition. A UDMH fire may be supported freely in air or it may be supported by an oxidizer, 
e.g., flare-type combustion. Due to the 3.1 psia (2,14x10'^ N/m^) vapor pressure at 80®F (26.7®C) 
and a wide flammability range, the possibility of an explosive mixture forming over the liquid is 
very high. Ignition can occur from an open flame or electric spark. UDMH is a convulsant agent, 
an irritant to the respiratory tract and eyes, and may irritate the skin. It may be absorbed by the 
skin, taken orally, or inhaled. Animal studies indicate that a mild anemia may follow exposure and 
that the most serious after-effect is convulsions. Depending on the degree of exposure, these range 
from tremors to acute convulsions. Chronic low level exposures may cause anemia. UDMH is 
compatible with most common metals. There is no known limitation on the use of UDMH with 
nickel, monel or many of the 300 series stainless steels. Aluminum and its alloys are also good for 
UDMH service when the water content is low. Usable non-metals include teflon, unplasticized 
Kel-F, polyethylene and certain butyl rubbers. 
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TABLE 6-IX. - LIQUID PROPELLANT CHARACTERISTIC SUMMARY 


Propellant 

Flash 

point 

Auto-ignition 

temp. 

Flammability 

range 

Vapor 

pressure 

Threshold 
limit value 

Material 

compatibility 

Stability 

Remarks 

UDMH 

Open cup 
(-15°C) 

Closed cup (TAG) 
34°F 

482°F 

(250°C) 

2% (LED to 
90% by volume 
at ambient 
temperature 

0.3 PS I A at 0° F 
(2.07x10^ N/m^ 
at-17.8°C) 

1.0 PS 1 A at 40°F 
(6.90x10^ N/m^ 

at 4.4°C) ^ 

3.1 PS 1 A at80°F 
(2.14x10^ N/m^ 

at 26.7°C) „ 
8.4PSIA at 120°F 

(5.80x10^ N/m^ 
at 48.9°C) 

0.5 ppm 
(1 mg/m3} 

Compatible 
with most 
common 
metals. Unsat. 
with copper 
& high copper 
content 
alloys 

Not shock 
or friction 
sensitive. 
Good ther- 
mal 

stability 

Hypergolic with 
some oxidants. 

Large flammability 
range and high 
vapor pressure makes 
this fuel very 
hazardous 

Liquid 

hydrogen 

N/A 

1075°F 

(579°C) 

4 to 75% 
by volume 
at68°F. 

(3.2 to 60 g/m^ 
at 20°C) 

1.9 PSIA at-433°F 
(1.31x10^ N/m^ 

at -258°C) o 

14.7 PSIA at -423 F 

(1.01x10^ N/m^ 
at -253°C) „ 

23.7 PSIA at -420°F 

(1.63x10^ N/m^ 
at-251°C) 
120PS!Aat-405°F 

(8.27x10^ N/m^ 
at -243°C) - 

162 PSIA at ~402"F 

(1.12x10® N/m^ 
at -241 °C) 

N/A 

Compatible 
with many 
metals except 
non-austenitic 
ferrous alloys 

Chemically 
stable when 
stored 
properly. 
Hydrogen- 
air mixture 
can be 
ignited by 
heat, spark 
or flame. 

Ignites readily over 
a wide range of 
mixture with air. 

Not toxic but low 
temperatures present 
personnel hazard. 
Highly reliable 
refrigeration is required 

Monomethyl- 

hydrazine 

Open cup (TAG) 
63°F (17.2°C) 

Open cup 
(Cleveland) 

70°F (21.1°C) 

382°F 

(194°C) 

2.5% (LED 
to 98% by 
volume at 1 
ATM. 

(1.013x105 N/m2) 

0.31 PSIA at40°F 

(2.14x10® IM/m® 
at 4.4°C) ^ 

1.0 PSIA at 80 F 

(6.9x10® N/m® 
at26.7°C) - 

3.1 PSIA at 120 “f 

(2.14x10^ N/m^ 
at48.9°C) ^ 

7.9 PSIA at 160°F 

(5.45x10^ N/m® 
at 71.1°C) 

0.2 ppm 
(.35 mg/m^) 
ceiling value, 
skin warning 

Compatible 
with some 
metals 

Stable 

except when 
influenced 
by copper, 
copper alloys, 
molybdenum 
or iron 
oxide 
catalyst 

Flammable over a large 
range of concentrations. 
Hypergolic with some 
oxidants. Causes 
spontaneous ignition of 
many common materials 
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TABLE 6-IX. - LIQUID PROPELLANT CHARACTERISTIC SUMMARY ~ Concluded 


Propellant 

Flash 

point 

Auto-ignition 

temp 

Flammability 

range 

Vapor 

pressure 

Threshold 
limit value 

Material 

compatibility 

Stability 

Remarks 

Hydrogen 
1 peroxide 
90% 

Is not flammable 
but reacts with 
flammable 
materials 

At 285°F 
(140.5°C) 
rapid boiling 
occurs and 
results in 
pressure 
increase in 
containers 

26 to 100 % 
by volume in 
air 

(explosive range) 

.05 PSIA at 68 ®F 
(3.45x10^ N/m^ 
at 20°C) „ 

.17 PSIA at 104°F 

(1.17x10^ N/m^ 
at 40°C) _ 

.52 PSIA at 140°F 

(3.59x10^ N/m^ 
at 60°C) - 

1.38 PSIA at 176°F 

(9.51x10^ N/m^ 
at 80°C) 

1 ppm 
Aerosai 
(1 mg/ m3) 

Compatible 
with some 
aluminum 
alloys, stainless 
steels, plastics, 
lubricants. 
Specific 
materials must 
be selected 
carefully 

Stable in 
properly 
passivated 
storage 
containers. 
Mixture 
with con- 
taminants 
can be shock 
sensitive 

Reacts very rapidly with 
many metals and 
organic contaminants 
It actively supports 
combustion by 
liberating oxygen 

Fuming 
nitric acids 

Doesn't burn 
by itself 

N/A 

N/A 

Must be . 
mixed with 
fuels 

0.2 PSIA «t 0°F 
(1.38x10^ N/m^ 
at-17.8°C) 

2.7 PSIA at77®F 
( 1 . 86 x 10 ^ N/m^ 
at 25°C) 

5.0 PSIA at100°F 
(3.45x10^ N/m^ 

at37.8°C) . 

15.0 PSIA at148°F 

(1.03x10® N/m^ 
at 64.4°C) 

Nitric 
acid vapor 
2 ppm 
(5 mg/m3) 
Nitrogen 
dioxide 
5 ppm 
(9 mg/rn3) 

Compatible 
with many 
aluminum and 
stainless 
steels. Unsat, 
with many 
ferrous and 
metals 

Stable to 
all types 
of mechani- 
cal shock 
and impact 

Hypergolic with 
some fuels. Liberated 
fumes support com- 
bustion. Toxic 
properties of nitric 
oxides make this 
oxidant hazardous to 
personnel 

Nitrogen 

tetroxide 

Doesn't burn 
by itself 

N/A 

N/A 
Must be 
mixed with 
fuels 

4.8 PSIA at30°F 
(3.31x10^ N/m^ 
at1.1°C) 

14.6 PSIA at 70°F 

( 1 . 01 x 10 ® N/m^ 

at21.1°C) o 

38.6 PSIA at 110°F 

( 2 . 66 x 10 ® N/m^ 
at 43.3°C) ^ 

91.0 PSIA at 150°F 
(6.27x10® Wrrr 
at 65.6°C) 

NO 25 ppm 

(9 mg/ m3) 
N 2 O 4 

2.5 ppm 
(9 mg/m3) 

Compatible 
with most 
common 
metals. Mois- 
ture content 
is leading 
factor 

Very 
stable at 
room 
tempera- 
ture 

Readily supports 
combustion. Hyper- 
golic with many 
fuels Toxic properties 
make this oxidant 
hazardous to personnel 

Liquid 

oxygen 

Doesn't burn 
by itself 

N/A 

N/A 
Must be 
mixed with 
fuels 

37 PSIAat-280°F 
(2.55x10® N/m^ 
at-173°C) „ 

167 PSIA at -260° F 

(1.15x10® N/m^ 
at-151°C) „ 

615 PSIA at-190°F 

(4.24x10® N/m^ 
at-123°C) 

N/A 

Compatible 
with many 
aluminum, 
steel, copper, 
and nickel 
alloys 

Chemically 
stable. Not 
shock 
sensitive 
but may 
form shock 
sensitive 
mixture 
with fuel 

Vigorously supports 
combustion. Not 
hypergolic but may 
form shock sensitive | 

mixtures with fuels. I 

Not toxic but low 1 

temperatures present | 

personnel hazard. | 

Highly reliable 1 

refrigeration is required. 






































6.2A.2 Inhibited/Red Fuming Nitric Acid (RFNA, IRFNA): Red Fuming Nitric Acid is a 
fuming liquid which has the color of reddish brown. It is an oxidizer which will not burn by itself; 
however, the fumes liberated by nitric acids support combustion. Spills may ignite materials such 
as wood or rope, and the fire will be typical of the materials burning. Aniline and other hypergolic 
fuels quickly ignite on contact with this acid. Once ignited, fuels undergo flare burning in contact 
with the acids. Although nitric acid is stable to mechanical shock and impact, upon contact with 
certain fuels (such as aniline or furfury I alcohol) it will react violently. It will form explosive mix- 
tures with non-hypergolic fuels and with hypergolic fuels. RFNA in contact with any surfaces of 
the body destroys tissue by direct action. RFNA vapors are highly irritating and toxic to the 
respiratory tract. A fatal pulmonary edema may develop. Many types of aluminum and stainless 
steels are compatible with the fuming nitric acids. However, careful material selection is required 
because many ferrous and nonferrous metals and their alloys will react with fuming nitric acid, 
producing toxic oxides of nitrogen as well as failures from corrosion. 

6.2. 4.3 Nitrogen Tetroxide {N2O4): Nitrogen tetroxide is a heavy brown liquid and gives off 
yellowish to reddish brown fumes. It is an oxidizer which will not burn by itself, but will support 
combustion. When mixed with fuel, it is readily combustible and is hypergolic with a number of 
fuels including UDMH, hydrazine, aniline, and furfuryl alcohol. N2O4 mixed with other combustible 
liquids which are not hypergolic presents an explosive hazard, particularly when subjected to elevated 
temperatures, pressure, or Impact. 

N2O4 in liquid form destroys body tissue. Severe burns of the skin and eyes can result 
from contact with liquid N2O4, It volatilizes readily, giving off vapors containing a mixture of N2O4 
and NO2. Inhalation of the N2O4 and NO2 vapors is normally the most serious hazard in handling 
N2O4 due to their low threshold limit values. 

N2O4 is not corrosive to most common metals but the selection is governed by the water 
content of the N2O4. Plastics such as teflon, Kel-F and lubricants of the fluorolube family are 
all compatible with N2O4. 

6.2. 4.4 Liquid Oxygen (LO2): LO2 is a light-blue transparent liquid which has a boiling 
point of -297.4°F (-183^0. It does not burn but vigorously supports combustion. Normally, it 
is not hypergolic with fuels. It will cause liquid fuels to cool and freeze if both liquids are brought 
together, resulting in a mixture that is shock-sensitive and which can react with the violence of a 
detonation. When mixed with L02» 3ll fuels that burn represent an explosion hazard. These mix- 
tures can be exploded by static electricity, mechanical shock, electrical spark, or other simitar 
energy sources. When LO2 is trapped in a closed system and refrigeration is not maintained, pressure 
rupture may occur. 

The health hazards of LO2 are associated with its very low temperature. If LO2 is spilled 
on the skin, an injury resembling a burn will occur. Oxygen gas is not toxic when inhaled, but it 
can cause some irritation to the upper respiratory tract. 

Materials used in LO2 systems must possess acceptable physical properties at extremely low 
temperatures. Metals such as 18-8 stainless steel, monel, aluminum and copper can be used in LO2 
operations. Non-metals usable include teflon, Kel-F, asbestos and special silicone rubbers. 



6.2. 4.5 Liquid Hydrogen {LH 2 ): High purity LH 2 is a transparent, colorless and odorless 
liquid with a boiling point of -423°F (-252.7*^0. It is readily ignited with air over a wide mixture 
range. A serious fire hazard always exists when hydrogen gas is present. Hydrogen will react violent- 
ly with strong oxidizers and will Ignite easily with oxygen. It reacts spontaneously with the fluorine 
and chlorine trifluoride. An explosion hazard can exist if liquid hydrogen is contaminated with 
oxygen or oxygen-enriched air. 

If liquid hydrogen is spilled on the skin. It can cause injury like a frostbite/burn. In the 
gaseous form, hydrogen acts as an asphyxiant by reducing the amount of oxygen normally present 
in air. 


Materials used in LH 2 systems must possess acceptable physical properties at extremely low 
temperatures. Several metals such as 300 and austenitic stainless steel, monel, aluminum and copper 
are acceptable for LH 2 application. Non-metals such as dacron, teflon, Kel-F and nylon are also 
usable. 


6.2.4.6 Monomethylhydrazine (MMH): MMH is a clear, water-white liquid with an odor 
similar to that of ammonia. MMH is flammable in a broad range of concentrations in air. It is 
hypergolic with some oxidants such as hydrogen peroxide, nitrogen tetroxide, fluorine, haligen 
fluoride, and nitric acid. A film of MMH in contact with metal oxides, such as those of Iron, copper, 
lead, magnesium, and molybdenum may ignite due to the heat of chemical reaction. Materials of 
large surface area such as rags, cotton waste, sawdust, excelsior, or other materials that have absorbed 
MMH may eventually cause spontaneous ignition. The vapors of MMH in air can be exploded by an 
electric spark or open flame. The liquid phase MMH is not sensitive to impact or friction. 

MMH is a strong irritant and may damage eyes and cause respiratory tract irritation. It is a 
volatile caustic liquid which can cause system toxicity by absorption through the skin as well as by 
inhalation. 

A few materials are acceptable for use in MMH systems. These materials include some 300 
series stainless steels, nickel, and some aluminum alloys. 

Non-metals such as teflon, Kel-F and high density polyethylene are also acceptable for MMH 

usage. 

6.2. 4:7 Hydrogen Peroxide (H 2 O 2 ): H 2 O 2 is a monopropellant and is an active oxidizing 
agent. It does not burn but vigorously supports combustion by oxygen liberation during decompo- 
sition. It reacts with many organic materials such as wood, cotton, grass, dirt, cigarette ashes, etc. 

It is also hypergolic with hydrazine and when mixed with organic solvents such as ketones, alcohols, 
and glycols, the solution becomes shock-sensitive. Materials containing silver, lead, chromium, 
mercury, and rust cause Immediate decomposition. Explosions will occur from stored H 2 O 2 when 
the containers are closed and contaminated. Principal personnel hazards involve contact of the 
liquid or vapor with eyes, inhalation of vapors, exposure of the skin to the liquid or high vapor 
concentrations and spillage on clothing resulting in fire. 
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Proper selection and passivation of materials for handling H 2 O 2 sre required. Aluminum 
and aluminum alloys, the 300 series stainless steels, Buna-N, Fluorel 2141, Kel-F, Viton A plastics 
and certain lubricants are compatible with H 2 O 2 . 


6.3 Liquid/Solid Hazard Comparison 

The inherent hazards involved In operations handling, transporting and storing of solid 
and liquid propellant systems are similar in many cases and yet very different in others because of 
their physical characteristics. In a liquid propulsion system the fuel and oxidizer must be transferred 
from tanks through valves, lines and fittings to a main combustion chamber. The delivery of the 
propellants from the tanks may require a gas pressurization system which pressurizes the storage 
tank to approximately 300500 psi while a turbine pump system requires a low tank pressure. These 
type systems are usually complex, susceptible to leaks, contamination and hardware failures. By 
contrast, the solid propulsion system contains a solid propellant, generally classified as composite 
or double base, which is molded into the combustion chamber/storage chamber during manufacturing. 
Therefore, no special ground support equipment/facilities or complex fueling/safety procedures are 
required for field operations. 

The primary hazards that operations, handling errors/malfunctions or extreme environments 
cause in liquid propellant systems are fire, explosions, toxicity and corrosion which occur because 
of leakage, spillage or mixing of the oxidizer and/or fuel. The primary solid propellant hazards are 
fire, explosion or detonation which may be caused by electrical signal, mechanical or blast shock, 
projectile penetration, high temperatures or some combination of these environments. 

In order to compare the liquid and solid hazards the results of the solid rocket hazard study 
of Section 6-I was subjectively compared to the results of the liquid rocket hazard study of Section 
6-2. The comparison is presented in Table 6-X. As shown, there are more hazardous incidents 
which could lead to catastrophic or critical conditions using a liquid system than when using a solid 
system. Therefore, the solid system should be considered safer than a liquid system from a system 
viewpoint. 


6.4 Conclusions 

The simplicity of solid propellant rocket handling and operation requirements make this type 
system a prime candidate for utilization on Shuttle payloads. Although the application of these 
systems present potential hazards to the Shuttle system, the hazards are readily eliminated, minimized 
or controlled to an acceptable level. Methods which assure that this has occurred are required as part 
of a system safety program. Detail hazard analyses are usually required on major programs. Hazard 
analyses outlined in the NASA System Safety Manual includes the following: 

(a) General Safety Studies 

(b) Preliminary Hazard Analysis 

(c) Fault Hazard Analysis 
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TABLE 6-X. - LIQUID AND SOLID HAZARD CLASS COMPARISON 


Error, malfunction; 
undesired event 

Liquid 

Hazard 

class 

C-Catastrophic 

CR-Critical 

Solid 

Hazard 

class 

C-Catastrophic 

CR-Critical 

Shuttle or Scout 
non-propulsion system 
fire 

Yes 

C 

Yes 

C 

Propulsion system 
fire 

Yes 

C 

Yes 

C 

Environmental 

heating 

Yes 

CR 

Yes 

CR 

Meteoroid impact 

Yes 

C 

Yes 

CR 

Spurious electrical 
signals 

No 

Note 1 

Yes 

C 

Vibration 

Yes 

C 

Yes 

CR 

Fragmentation from 
shuttle or Scout non- 
propulsion system 
rupture or explosion 

Yes 

C 

Yes 

CR 

Environmental shock 

Yes 

C 

Yes 

CR 

Electrical fault 

Yes 

Note 1 

Yes 

C 

Shock from shuttle 
or Scout non-oropul- 
slon system rupture 
or explosion 

Yes 

C 

Yes 

C 

Corrosion 

Yes 

C 

No - RCS 
system only 


Fuel pressure leak 
and oxidizer vent 
failure 

Yes 

C 

No 

RCS system 
only 


Fuel tank over- 
pressurized or punc- 
tured during abort or 
landing 

Yes 

C 

Puncture only 

CR 

Inadvertent fuel dump 

Yes 

C 

No - RCS 
system only 


Oxidizer leak 

Yes 

C 

No - RCS 
system only 


Fuel leak 

Yes 

C 

No 



1 . Most liquid rocket systems require multiple valves to function 

before a critical or catastrophic condition can occur. 1 73 




TABLE 6-X. - LIQUID AND SOLID HAZARD CLASS COMPARISON - Concluded 


Error, malfunction; 
undesired event 


Battery explosion 


Pressure vessel 
rupture 


Propellant tank 
rupture 


Dump lines wet 
during disconnect 
in orbit 

Unsuccessful deploy- 
ment in orbit 


Dump initiated with 
propellants not settled 
and system not 
designed to land fully 
loaded 


Dump system control 
failure and system 
not designed to land 
fully loaded 


Propellant spills 
during ground vent 
and line purge, tank 
drain following abort 
landing 


Collision during 
ground handling 


Crash landing plus 
depressurized fuel tank, 
with full propellants 


Pressure regulator 
fails open during 
propellant dump 


Residuals remain in 
fuel dump line 


Liquid 


Hazard 

class 

C-Catastrophic 

CR-Critical 


Solid 


Hazard 

class 

C-Catastrophic 

CR-Critical 
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(d) Logic Diagram Analysis 

(e) Procedure Analysis 

In this study the preliminary hazard analysis approach was used to analyze the hazardous 
situations of solid rocket propulsion systems and their interface with the Orbiter vehicle. To 
perform the study, the third and fourth stages of the Scout launch vehicle were used as a typical 
propulsion systems. In general it was determined that safety procedures, qualification tests, payload 
pallet design, thermal insulation and electrical system design considerations can be used to provide 
hazard reduction or elimination. In reference to the Scout launch vehicle, the use of system and 
mission features such as over-board discharge of PCS system relief effluent, ignition delay until 
sufficient separation from the Orbiter is realized, and electro-mechanical safe and arm devices on the 
solid rockets can provide further hazard reduction. 

Liquid systems, such as the Agena bipropellant or the Scout reaction control monopropellant 
system, are considered complex when compared to the typical solid rocket from the handling, check- 
out and operation standpoints. Liquid systems normally contain inherent hazards in at least three 
areas: high pressure gas systems, ordnance devices and propellants. The liquid propellants normally 
used in upper stage vehicles are not impact or shock sensitive when stored in an uncontaminated 
condition, however, when contaminated with other fluids some become sensitive. These inherent 
hazards become very vivid when incidents/accidents cause a fire, explosion, contamination reaction 
or toxic conditions. The main concern related to liquid systems is to provide an environment such as 
temperature, shock, vibration, impact or tank pressures which will prevent the fuel and oxidizer from 
mixing in any form inadvertently. Also liquid propellants provide handling hazards to personnel 
which range from skin burns, frostbite, and eye damage to toxic inhalation and skin absorption. 

Solid propellant systems such as the Scout, Burner II and Delta upper stages, are considered 
in general to be simple systems when approached from the handling, checkout and operation view- 
point. Solid motors do present hazards from possible ignition, explosion/deflagration or detonation. 
However, extensive past usage of both liquid and solid systems has shown that most hazards can be 
eliminated or controlled by good system design, trained personnel, safe handling equipment and 
detailed safety/handling and checkout procedures. Also, the many inherent hazards involved with 
field handling of liquid propellants are mostly eliminated by the use of solid propellants. 

It was shown from a comparison of the PHAs of the liquid and solid propellant systems that 
liquids inherently have more hazardous situations or conditions which could be catastrophic or 
critical to the Shuttle system than the solid propellant systems. From a system's viewpoint the solid 
system should be considered much safer than a liquid system and therefore more desirable for use 
as a Shuttle payload system. 
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1.0 SAMPLE CALCULATIONS: LIQUID PROPELLANT HAZARD EFFECTS 


1.1 Introduction 

The following examples are presented so that the method of determining peak side-on 
overpressure, explosive yield and specific impulse for liquid propellants can be reviewed. These 
examples include the three (3) propellant mixing modes, confinement by missile (CBM), high 
velocity impact (HVI), and confinement by ground surface (CBGS). 


1.2 Example 1: 


Propellant — Hypergolic 

Combined mass of propellant and oxidizer — 22,000 Ibm (10,000 kg) 

Failure mode — CBM 

Solution: Examine Table 5-1 for “Part 1“ and “Part 2“ solution sequences. 

Part 1 : Table 5-11 implies that for the CBM failure mode, 

Y = 0.01 - 0.8% 

Using the higher portion for safety reasons, 

Y = 0.8% 


Part 2: Figure 5-20 implies that for a combined mass of propellant and oxidizer 
of 22,000 Ibm (10,000 kg) 

Y = (240%) (0.37) = 88.8% 

where 240% is the hypergolic multiplier factor, 

Y = 0.8%, the smaller value, is the correct choice. 

Assume Standoff distance R (assumption) — 164 ft (50 m) 


Solution: 


( 1 ) 

( 2 ) 


Terminal yield y - 0.8% 


W = Wj X 


J 

100 % 


W = 22,000 Ibm x 


0 . 8 % 

100 


W = 176 Ibm (80 kg) 

(3) Scaled distance R/Wl/3 = 164 ft/176 Ibm'’^^ = 29.31 ft/lbm”'/^ (11.6 m/kg”*/^) 

(4) Table 5— 1 1 1 indicates: 

Acquire P, peak pressure, from Figure 5—28. 

Acquire l/Wl/3 scaled impulse, from Figure 5—30. 

(5) From Figure 5-28, P = ll.Opsi (7.58 x lO^N/m^) 

(6) From Figure 5-30, l/W^/^ = .q02 psl-sec/lbm^/^ (27 N/m^ s/kg'’ 
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(7) 



= 1.112x 10’2 psi/sec (116.2 N/m^/s) 


1.3 Example 2: 


Propellant — Hypergolic 

Combined mass of propellant and oxidizer — 2200 Ibm (1000 kg) 

Failure mode — HVI 

Impact velocity (assumption) — 459 ft/sec (140 m/s) 

Type of surface impacted — hard 

Solution: Examine Table 5—1 for "Part 1" and "Part 2" solution sequences. 

Part 1 : Figure 5-21 implies that for an impact velocity of 459 ft/sec (140 m/s) 
onto a hard surface, Y = 15%. 

Part 2: Figure 5-20 implies that for a combined mass of propellant and oxidizer 
of 2200 Ibm (1000 kg) 

Y = (240%) (0.6) = 144% 

where 240% is the hypergolic multiplier factor 

Y = 15%, the smaller value, is the correct choice. 


1.4 Examples: 

Propellant and oxidizer — L02/RP-1 

Combined mass of propellant and oxidizer — 22,000 Ibm (10,000 kg) 

Failure mode — CBM 

Ignition time (assumption) — 0.2 seconds 

Solution: Examine Table 5—1 for "Part 1" and "Part 2" solution sequences. 

Part 1 : Figure 5-22 implies that for an ignition time of 0.2 seconds, Y = 52% 

Part 2: Figure 5-20 implies that for a combined mass of propellant and oxidizer 
of 22,000 Ibm (10,000 kg) 

Y= (125%) (0.37) = 46% 

where 125% is the LO 2 /RP-I multiplier factor. 

Y = 46%, the smaller value, is the correct choice. 


1.5 Example 4: 

Propellant and oxidizer — LO 2 /RP-I 

Combined mass of propellant and oxidizer — 330,000 Ibm (150,000 kg) 
Failure mode — CBGS 

Impact velocity (assumption) — 32.8 ft/ sec (10 m/s) 

Ignition time (assumption) — 0.5 seconds 
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Solution: Examine Table 5-1 for "Part 1" and "Part 2" solution sequences. 
Parti: Equation 5-1 implies that for an impact velocity of 32.8 ft/sec (10 m/s) 

Y = 5% + _ 32 3 

(3.28106 ft/sec) 

= 5% + 68.2% 

Y,^ = 73.2% 

Figure 5-23 implies that for an ignition time of 0.5 seconds 

Y X 100 


or 
Y = 


(70) 

( 100 ) 


Y 


m 


Y = -1Z2L (73.2%) = 51.2% 
( 100 ) 


Part 2: Figure 5-20 Implies that for a combined mass of propellant and oxidizer 
of 330,000 Ibm ( 1 50,000 kg) 

Y = (125%) (0.05) = 6.25% 

where 125% is the LO2/RP-I multiplier factor. 

Y = 6.25%, the smaller value, is the correct choice. 

Standoff distance (assumption) — 328 ft (100 m) 


Solution: 

(1) Terminal yield y = 6.25% 

6.25% 


(2) w = 


W = 330,000 Ibm X 
W = 20,625 Ibm (9364 kg) 


(3) Scaled distance R/W^/^ = 328 ft/(20625)^/3 = 12 ft/lbm^/^ 

(4) Table 5-1 1 1 indicates 


(4.8 m/kg^/3) 


Acquire P, peak pressure from Figure 5-32 
Acquire l/W scaled impulse from Figure 5-34 

(5) From Figure 5-32, P = 5.5 psL(3.8 x 10^ N/m^) 

(6) From Figure 5-34, l/W^^^ = .0061 psi-sec/lbm^/3 (55 N/m^/kg'^/^) 

(7) I = (W^^^) = 0.168 psi sec (1 160 N/m^s) 
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1.6 Examples: 


Propellant and oxidizer — LO 2 /LH 2 

Combined mass of propellant and oxidizer — 22,000 Ibm (10,000 kg) 
Failure mode — HVI 

Impact velocity (assumption) — 131 ft/sec (40 m/s) 

Type of surface impacted — hard 

Solution: Examine Table 5-1 for "Part 1" and "Part 2" solution sequences 

Pgt't 1 : Figure 5-21 implies that for an impact velocity of 131 ft/sec (40 m/s) 
Y = 30% 


Part 2: Figure 5-20 implies that for a combined mass of propellant and oxidizer 
of 22,000 Ibm' (10,000 kg) 

Y= (370%) (.37) = 137% 
where 370% is the LO 2 /LH 2 multiplier factor 
Y = 30%, the smaller value, is the correct choice 
Standoff distance (assumption) — 328 ft (100 m) 

Solution: 

(1) Terminal yield y = 30% 


( 2 ) 


W = Wj X 


y 

100 % 


W = 22,000 Ibm x 


30% 

i"oo~ 


W = 6600 Ibm (3000 kg) 

(3) Scaled distance R/Wl/3 = 328 ft/(6600 Ibm)^/^ = 17.5 ft/lbm^/^ (6.9 m/kg^/^) 

(4) Table 5-1 1 1 indicates: 


Acquire P, peak pressure, from Figure 5-36 

Acquire l/W^^^, scaled impulse, from Figure 5-38 

(5) From Figure 5-36 , P = 3.19 psi (2.2 x 10^ N/m^) 

(6) From Figure 5-38, l/W^^^ = .0051 psi-sec/lbm^/^ (45 N/m^/kg^^^) 

(7) I = (w''/3) = 0.094 psi sec (649 N/m^) 
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1.0 MISCELLANEOUS STANDARD HAZARDS TESTING PROCESSES 


1.1 Introduction 

The following standardized hazards testing processes were abridged from Vol II of reference 
6 and are presented so that the reader may have a condensed reference of other hazard testing. 
Additional data, including fetches, a description of the testing apparatus and a discussion of appli- 
cation of the data, are contained in the given reference. 


1.2 Differential Thermal Analysis (DTA) 

(a) Objective — To detect exothermic and endothermic reactions in a propellant or 
constituent as heat is applied at a given input rate and to determine the relative 
magnitude of these exotherms and endotherms. 

(b) Operating Principle — The sample and an inert reference material are heated 
simultaneously at the same caloric rate. The exotherm or endotherm is measured 
by the differing temperature recordings on a common time base. 

(c) Test Analysis and Limitations — Differential thermal analyses for elevated 
temperature sensitivity have gained the widest acceptance of any thermal test 
for propellants, components, and intermediate mixtures. DTA yields not only 
decomposition temperatures at various rates of temperature rise but also, by 
proper selection of heating rates, thermodynamic constants which are useful 
in basic kinetics studies of propellant grain stability in large sizes. The DTA 
test has its greatest value in the detection of unsuspected endothermic or 
exothermic reactions of new compositions and providing qualitative estimates 
of their effect. Quantitative assessment of the effects required measurements 
of heat capacities and heat transfer constants. 

1.3 Self -heating Test 

(a) Objective — To determine the temperature at which a given mass and configuration 
of propellant will commence self-heating to destruction from its own decomposition 
exotherm. 

(b) Operating Principle 

(c) Cook-Off Tests — Progressively larger regular-shaped pieces of propellant(for example, 
right cylinders), instrumented with internal thermocouples, are maintained at elevated 
temperature under a constant heat-transfer environment until deflagration occurs. 

(d) DTAs at Differing Heating Rates - The DTA is performed at a number of different 
heating rates from 1.0 to 10.0°C per minute, and the data are plotted as log heating 
rate vs.l/T, where T Is the absolute temperature of the first exotherm. 
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(e) Self-H eating Determination in an Isothermal Environment — The rate of change in 
temperature is measured at the center, the surface, and one point on a radius of 
cylindrical propellant charges being heated in a constant temperature bath of 
established heat transfer coefficient. For all determinations, it is necessary to acquire 
values on the propellant for thermal conductivity, density, and heat of explosion. 

(f) Test Analysis and Limitations - The evaluation of kinetic constants on a larger 
scale than the DTA test is desirable In order to decrease the amount of extrapolation 
needed to predict the hazard for large motors by providing values at lower tempera- 
tures. In the case of the method which utilizes an isothermal environment, knowing 
the rate of temperature rise at that time when no temperature gradient exists at the 
center, allows calculation of activation energy, as does also measurement of the 
thermal gradient when equilibrium is established in the bath; provided in this latter 
case, that the right bath temperature has been selected. 

The self-heating tests described here pertain only to finished, cured, homogenously mixed 
propellant. A further limitation is that one exothermic reaction must predominate and that it not 
be complexed with a simultaneous endotherm (for example a crystalline form change in the oxidizer). 
This is necessary in order to obtain sufficiently clearcut datum points to permit plotting of the curve 
for activation energy. The limitation of these self-heating tests to cured, homogeneous propellants 
without voids rules out their use for one of the most serious propellant processing hazards; namely, 
the destructive exothermic effect that results from high local concentration of reactive species 
during mixing (for example, high local concentrations of polymerization accelerators or burning 
rate catalysts with oxidizer). These high local concentrations can result from such factors as 
agglomeration, improper order of addition of components to the mixer, "dead spots in the mixer 
movement, etc. The only known testing method for assessing this high local concentration hazard 
is to deliberately put together the anticipated mal-mixture and to test for exothermic effect at 
various concentrations by conventional DTA techniques. 


1.4 Copper Block Test 

(a) Objective - To express the auto-ignition temperature of the substance by an 
empirical test method. 

(b) Operating Principle - A small sample is heated at a constant rate in a fixed environ- 
ment until ignition occurs. The temperature of ignition is observed. 

(c) Test Analysis and Limitations - This test is a simple, economical method for express- 
ing the comparative stability of substances to heat. However, the auto-ignition 
temperatures obtained would differ in most cases if a different rate of heating was 
used. Also, it makes no provision for detecting more than one decomposition 
reaction, successive endotherms or exotherms, etc. Accordingly, the test is not nearly 
as informative as auto-ignition temperatures determined in the DTA. 
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1.5 WenogradTest 

(a) Objective — To determine the temperature of explosion under conditions of minimal 
heat transfer effects. 

(b) Operating Principle — A small sample of the explosive is heated by electrical capacitor 
discharge. Electronic recording of the temperature at which explosion occurs is 
achieved within 20 microseconds by means of an oscilloscope. 

(c) Test Analysis and Limitations — Thermal test methods described previously all have 
an appreciable heat transfer factor, such that recorded times and temperatures 
cannot be regarded as a true integral of the total heat input to the entire mass of 

the sample. In an effort to minimize this heat transfer lag, Wenograd devised an ohmic 
heating mechanism for a very small sample, with instrumentation for an electronic 
response triggering mechanism and temperature recording. 

In a critical review and confirmation of the Naval Ordnance Laboratory's test 
result with the Wenograd test, workers at Stanford Research Institute affirmed that 
the test measures a "true" induction time for the explosive, rather than the time 
required for a physical effect, such as heatup of the sample. Explosion times in the 
Wenograd test are believed to have the same characteristic times as response in the 
impact test. The order of numerous explosives correlates well in the two tests. 


1.6 Tallani Test 

(a) Objective — To gauge the temperature sensitivity of materials by measurement of the 
gas evolution pressure. 

(b) Operating Principle — The sample is placed in an enclosed system and is maintained 
at a constant elevated temperature in a heating block. The pressure and pressure- 
change-rate are plotted at fixed time intervals. 

(c) Test Analysis and Limitations — The test is most useful as a sensitivity criterion for 
double base propellants and^itrocellu lose. It has questionable util ity for compounds 
containing the nitro or any other phosphoric groups except the nitrate group. 

1.7 Standard Heat Tests 

(a) Objective — To evaluate thermal stability by loss in weight at an arbitrary fixed 
temperature. 

(b) Operating Principle and Test Description - A number of empirical heat tests can be 
used, adapted principally from the high explosives and pyrotechnics industries, e.g., 
the 75^C International Test and the lOO^C Heat Test. In the Standard Heat Test, 
for example, a 0.6g sample Is heated in an open test tube at 100°C for 96 hours. To 
qualify, an arbitrary value may be set, such as, the sample must lose less than 2% 
weight in 48 hours. 
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(c) Test Analysis and Limitations - As with most of these empirical tests, the results 
are meaningful only in comparison with substances of established sensitivity that 
have been tested in the past. The hazards analysis of manufacture of a new product 
could thus be comparatively expressed in this manner. 

1.8 K1 -Starch Test 

(a) Objective - To evaluate the thermal stability of nitrato compounds by their time 
to react with a standard indicator paper. 

(b) Operating Principal and Test Description — The potassium iodide-starch indicator 
paper test is conducted at 82.2"C for nitroglycerin and at 65.5°C for double base 
propellants and nitrocellulose. The test paper is moistened with a glycerin-water 
solution and the time to coloration is reported. Standard grades of military nitro- 
cellulose are required to have a 65.5°C Kl test value of 35 minutes minimum. 

(c) Test Analysis and Limitations — The test is most useful as a sensitivity criterion for 
double base propellants and nitrocellulose. It has questionable utility for compounds 
containing nitro or any other phosphoric groups except nitrato. 

1.9 Methyl Violet Test 

(a) Objective — To evaluate the thermal stability of nitrato compounds by the time to 
react with standard indicator paper. 

(b) Operating Principle and Test Description - Methyl violet indicator paper testing Is 
done at 120°C for propellants and at 134.5°C for double base and nitrocellulose 
compositions. Samples are heated up to five hours and times are recorded to paper 
coloration, evolution of red fumes, and/or explosion of the sample. 

(c) Test Analysis and Limitations — The test is most useful as a sensitivity criterion for 
double base propellants and nitrocellulose. It has questionable utility for compounds 
containing nitro or any other phosphoric groups except nitrate. 

1.10 Electrostatic Discharge 
1.10.1 Basic Electrostatic Discharge Test 

(a) Objective — To determine whether an electrostatic discharge will initiate an energetic 
material. 

(b) Operating Principle — Electrostatic energy stored in a charged capacitor Is discharged 
to the sample material to be tested. Materials initiated below 0.015 joule are con- 
sidered hazardous for direct handling since this value is approximately that which 
individuals can generate. In this case the Human Spark Discharge test (see 1.10.2) is 
employed. 
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(c) Test Analysis and Limitation — The electrostatic energy discharge to the test 

specimen is calculated from the relationship E = V 2 CV where E = energy (joules), 

C = electrical capacitance (farads), and V = charging potential (volts). Currently, 
electrostatic discharge data do not reflect energy losses in conductors, discharge gap, 
and resistivity of the test specimen. These factors lower the discharge energy and the 
rate at which the energy is delivered. In addition, this type of test method does not 
provide for testing at different discharge rates to simulate all possible process 
conditions. 

1.10.2 Electrostatic Discharge Human Spark Test 

(a) Objective - To establish the susceptibility of an energetic material to initiation 
when subjected to the electrostatic discharge generated by humans. 

(b) Operating Principle — Electrostatic energy accumulated on an electrically isolated 
human is discharge to the sample to be tested. 

(c) Test Analysis and Limitations - The electrostatic energy discharged to the sample is 
calculated by applying the relationship E = CV where E = energy (joules), C - 
capacitance (farads), and V = charging potential (volts). An average capacitance for 
the human body is 300 picofarads,* This technique does not allow for the different 
discharge rates that would be available from different individuals because of varying 
skin or contact resistances. 

1 . 1 0.3 Electrostatic Hazards Analysis 

(a) Objective — To quantitatively assess electrostatic discharge initiation hazards during 
handling and manufacturing activities involving combustibles, explosives and solid 
propellant materials. 

(b) Operating Principle and Hazard Criteria - The Systems Engineering Approach to 
Hazards Analysis is used to make realistic estimates of the electrostatic hazard 
associated with handling or processing sensitive material. The response of materials 
to electrostatic discharge stimulus is determined initially in suitable tests which yield 
the "no initiation" energy (joules). This threshold value is compared to the electro- 
static energy possible during manufacture determined by appropriate in-process 
measurement and/or theoretical calculations. Operations are considered hazardous 
when the electrostatic energy potential during the suspected operation exceeds the 
threshold initiation level for the subject material. The human body can precipitate 
an electrostatic discharge hazard when the material is initiated by electrical discharges 
less than 0.015 joule. Assessment of this situation requires employment of the Human 
Spark Discharge tests. 

(c) Analysis Limitations - The simulated in-process tests are a more realistic analysis 
since the experiments take into account "energy losses" attributable to resistance 
(material, air gap, lines, etc.) and inductance and duplicate the rate at which energy 
is applied to the sample for a particular equipment piece or body. The threshold 
electrostatic discharge level obtained using the spark test may be conservative if 

300 picofarads is consistent with the .015 joules energy of paragraph 1.10.1 at only 10,000 volts. 
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inductance and resistance generally are less than the environment under consideration. 
To be totally applicable the electrostatic discharge test equipment circuitry should 
duplicate these variables in the discharge path. This more costly and more extensive 
test procedure is needed only when the material is known to be borderline or when 
analysis shows that a hazard truly exists. 


1.11 Thin Film Propagation Test 

(a) Objective — To determine whether a thin film of explosive material, once initiated, 
can transmit to a more intense reaction and consume the material at this increased 
rate. 

(b) Operating Principle — A liquid explosive of varying thicknesses simulating process 
conditions is initiated by impact, and the extent and rate of reaction are established 
by monitoring the pressure front accompanying the explosive reaction. 

(c) Test Analysis and Limitations — Data from this test give the frequency and extent 
of propagation of reaction from an impact initiated sample. Also, the instrumenta- 
tion employed gives the extent of a propagation as a function of time, thereby 
yielding propagation velocity. A typical set of data could be: 

Propagation frequency 66% 

Propagation extent 2 inches 

Propagation velocity 1200-1500 meters/ second 

This test can be used to determine not only the effects of sample dimensions but also of 
energy input and materials of fabrication on the extent and velocities of the propagating reaction. 
Use of the test is limited to testing those materials reacting strongly enough to activate the pressure- 
sensitive probe system. 


1.12 Dust Explosibility Test 

(a) Objective — To determine whether a finely divided solid material will react explosive- 
ly when dispersed in a gaseous medium and ignited. 

(b) Operating Principle 

(c) Threshold Dust Concentration — Finely divided explosive dusts are dispersed into an 
energy source in air to determine the threshold explosive dust concentration. 

(d) Threshold Electrostatic Discharge — Dust air mixtures in the explosion range are 
subjected to condenser discharge sparks to determine the threshold electrostatic 
discharge energy for highly explosive dust-laden atmosphere. 

(e) Test Analysis and Lim i tation — Data from this test are reported as threshold dust 
concentrations (oz/ft^), meaning the concentration of dust must exceed this level to 
explode, and the threshold electrostatic discharge energy (joules), if exceeded, will 
initiate an explosive reaction in the dust/air mixture. 
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Test capabilities permit establishing explosibility characteristics of a material 
under different media for evaluating compositional effects, and the relative benefits 
of inert gases or additives for eliminating a dust explosion. The test yields relative 
values which are influenced by such factors as the chemical and physical properties 
of the dust, uniformity of the dust cloud, properties of the atmosphere, ignition 
source and environmental conditions. 


1.13 Critical Height To Explosion (Transition) Test 

(a) Objective - To determine if a material will react explosively when initiated by flame. 

(b) Opera^n^Prtnciple - Materials are submerged and surface flame initiation under 
environmental process conditions to determine if a material will react explosively for 
a specific operation. 

(c) Test Analysis and Limitations - Whether a material explodes or detonates is, for 
practical purposes, of little consequence since both reactions result in destruction 
of facilities and possible personnel injury. Since material explosion heights are 
generally lower than detonation heights, the safety of personnel and protection of 
plant operations dictate that the no-explosion level be employed in process hazard 
evaluation studies. 

Critical heights to explosion (CHg) data are reported as the material height 
(inches) above which an explosive reaction can occur for a given container diameter. 
The data are valid within the limits of test container sizes and confinement and 
assuming submerged initiation, equal to a 12 gram bag igniter. Application to process 
hazard analysis studies assumes the critical height to explosion Increases with the 
charge diameter. It Is expected that the effect of diameter on CHg will diminish as 
this dimension increases. These data are representative of a highly transient reaction 
and may not be indicative of a situation where the material continues to burn. In the 
latter case, cook-off data would be more applicable. The critical height test permits 
testing of solids, liquids, and mixtures used In propellant manufacture. The test can 
also be used to verify benefits of recommended material modifications to eliminate 
or minimize transition hazards. Further, the test can be used to implement investiga- 
tions of influencing factors such as initiation energy, density, temperature, design 
configuration, and degree and material of confinement. 


1.14 Critical Diameter for Propagation Test 

(a) Objective - To determine if a material will propagate an explosive reaction when 
subjected to induced shock'and to establish the critical dimension for nonpropagation. 

(b) Operating Principle - Materials are purposely shocked by pressures of a detonating 
high-energy donor to determine If a material dimension is capable of propagating an 
explosive reaction. The dimensions of the material are varied under specific environ 
mental process conditions to establish the critical non-propagating dimension. 
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(c) Test Analysis and Limitation — Critical diameter data are reported as the confined 
or unconfined material diameter (inches) at which an explosion reaction will not be 
propagated. Application to process hazard analysis studies assumes an initiation has 
occurred and has progressed to an explosion reaction equal to or greater than that 
characteristic of the Composition C-4 booster material. Degree of confinement can 
influence test results and thus must be considered in applying the data. 

The critical diameter test permits testing of solids, liquids, and mixtures that 
may occur during propellant manufacture. In addition, benefits of recommended 
material modification to eliminate potential propagation hazards are easily verified 
as are results of studies to Investigate density, temperatures, confinement, and high 
and low-reaction rate phenomena with liquid and solid explosives. 

1.15 Bottle Drop Test 

(a) Objective — To assess the hazards associated with the inadvertent dropping of explo- 
sive liquids during transport or sampling. 

(b) Operating Principle — Containers of explosive liquids, preferably of the same geometry 
as those used in the process, are dropped from various heights to determine if the test 
liquid can be initiated in this type of environment. 

(c) Test Analysis and Limitations — Some explosive liquids have been initiated into low 
velocity explosive reactions by relatively small energy inputs; stress concentrations 
and cavitation in the liquid being deemed the mechanism of initiation. At the stage 
of development of a new explosive liquid when two to five pound quantities are 
available, this test has been used to assess the hazard of an inadvertent drop of the 
material. The bottle drop test has the limitation, as does all sensitivity testing, of 
possibly finding only an unsafe condition while giving no information as to a safe 
condition. 


1.16 Shear Water Hammer Test 

(a) Objective — To determine if a moving bed of an explosive mixture in a slurry form 
can be initiated by sudden deceleration. 

(b) Operating Principle — Thus far, use-type tests in which the material in question is 
dropped or shot onto a steel plate have proved the most useful. 

(c) Test Analysis and Limitations — Test results on the slurries investigated thus far 
have shown a velocity requirement greatly exceeding that available in the process. 
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